Computer Forensics: Investigating Network Intrusions and Cybercrime

|

EC-Council Press

The Experts: EC-Council EC-Council’s mission is to address the need for well educated and certified information security and e-business practitioners. EC-Council is a global, member based organization comprised of hundreds of industry and subject matter experts all working together to set the standards and raise the bar in Information Security certification and education. EC-Council certifications are viewed as the essential certifications needed where standard configuration and security policy courses fall short. Providing a true, hands-on, tactical approach to security, individuals armed with the knowledge disseminated by EC-Council programs are securing networks around the world and beating the hackers at their own game.

The Solution: EC-Council Press The EC-Council | Press marks an innovation in academic text books and courses of study in information security, computer forensics, disaster recovery, and end-user security. By repurposing the essential content of EC-Council’s world class professional certification programs to fit academic programs, the EC-Council | Press was formed. With 8 Full Series, comprised of 27 different books, the EC-Council | Press is set to revolutionize global information security programs and ultimately create a new breed of practitioners capable of combating this growing epidemic of cybercrime and the rising threat of cyber war.

This Certification: C|HFI – Computer Hacking Forensic Investigator Computer Hacking Forensic Investigation is the process of detecting hacking attacks and properly extracting evidence to report the crime and conduct audits to prevent future attacks. The C|HFI materials will give participants the necessary skills to identify an intruder’s footprints and to properly gather the necessary evidence to prosecute.

Additional Certifications Covered By EC-Council Press: Security|5 Security|5 is an entry level certification for anyone interested in learning computer networking and security basics. Security|5 means 5 components of IT security: firewalls, anti-virus, IDS, networking, and web security.

E|DRP – EC-Council Disaster Recovery Professional E|DRP covers disaster recovery topics, including identifying vulnerabilities, establishing policies and roles to prevent and mitigate risks, and developing disaster recovery plans.

Wireless|5 Wireless|5 introduces learners to the basics of wireless technologies and their practical adaptation. Learners are exposed to various wireless technologies; current and emerging standards; and a variety of devices.

C|EH - Certified Ethical Hacker Information assets have evolved into critical components of survival. The goal of the Ethical Hacker is to help the organization take preemptive measures against malicious attacks by attacking the system himself or herself; all the while staying within legal limits.

Network|5 Network|5 covers the ‘Alphabet Soup of Networking’ – the basic core knowledge to know how infrastructure enables a work environment, to help students and employees succeed in an integrated work environment.

E|NSA – EC-Council Network Security Administrator The E|NSA program is designed to provide fundamental skills needed to analyze the internal and external security threats against a network, and to develop security policies that will protect an organization’s information. E|CSA - EC-Council Certified Security Analyst The objective of E|CSA is to add value to experienced security professionals by helping them analyze the outcomes of their tests. It is the only in-depth Advanced Hacking and Penetration Testing certification available that covers testing in all modern infrastructures, operating systems, and application environments.

Investigating Network Intrusions and Cybercrime EC-Council | Press Volume 4 of 5 mapping to ™

C HFI Computer

Hacking Forensic INVESTIGATOR

Certification

Australia • Brazil • Japan • Korea • Mexico • Singapore • Spain • United Kingdom • United States

Investigating Network Intrusions and Cybercrime: EC-Council | Press Course Technology/Cengage Learning Staff: Vice President, Career and Professional Editorial: Dave Garza

© 2010 EC-Council ALL RIGHTS RESERVED. No part of this work covered by the copyright herein may be reproduced, transmitted, stored, or used in any form or by any means graphic, electronic, or mechanical, including but not limited to photocopying, recording, scanning, digitizing, taping, Web distribution, information networks, or information storage and retrieval systems, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without the prior written permission of the publisher.

Director of Learning Solutions: Matthew Kane Executive Editor: Stephen Helba Managing Editor: Marah Bellegarde Editorial Assistant: Meghan Orvis Vice President, Career and Professional Marketing: Jennifer Ann Baker Marketing Director: Deborah Yarnell

For product information and technology assistance, contact us at Cengage Learning Customer & Sales Support, 1-800-354-9706 For permission to use material from this text or product, submit all requests online at www.cengage.com/permissions. Further permissions questions can be e-mailed to [email protected]

Marketing Manager: Erin Coffin Marketing Coordinator: Shanna Gibbs Production Director: Carolyn Miller

Library of Congress Control Number: 2009933550

Production Manager: Andrew Crouth

ISBN-13: 978-1-4354-8352-1

Content Project Manager: Brooke Greenhouse

ISBN-10: 1-4354-8352-9

Senior Art Director: Jack Pendleton

Cengage Learning 5 Maxwell Drive Clifton Park, NY 12065-2919 USA

EC-Council: President | EC-Council: Sanjay Bavisi Sr. Director US | EC-Council: Steven Graham

Cengage Learning is a leading provider of customized learning solutions with office locations around the globe, including Singapore, the United Kingdom, Australia, Mexico, Brazil, and Japan. Locate your local office at: international.cengage.com/region Cengage Learning products are represented in Canada by Nelson Education, Ltd. For more learning solutions, please visit our corporate website at www.cengage.com

NOTICE TO THE READER Cengage Learning and EC-Council do not warrant or guarantee any of the products described herein or perform any independent analysis in connection with any of the product information contained herein. Cengage Learning and EC-Council do not assume, and expressly disclaim, any obligation to obtain and include information other than that provided to it by the manufacturer. The reader is expressly warned to consider and adopt all safety precautions that might be indicated by the activities described herein and to avoid all potential hazards. By following the instructions contained herein, the reader willingly assumes all risks in connection with such instructions. Cengage Learning and EC-Council make no representations or warranties of any kind, including but not limited to, the warranties of fitness for particular purpose or merchantability, nor are any such representations implied with respect to the material set forth herein, and Cengage Learning and EC-Council take no responsibility with respect to such material. Cengage Learning and EC-Council shall not be liable for any special, consequential, or exemplary damages resulting, in whole or part, from the readers’ use of, or reliance upon, this material.

Printed in the United States of America 1 2 3 4 5 6 7 12 11 10 09

Brief Table of Contents TABLE OF CONTENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .v PREFACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii CHAPTER 1 Network Forensics and Investigating Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1 CHAPTER 2 Investigating Network Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-1 CHAPTER 3 Investigating Web Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1 CHAPTER 4 Router Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 CHAPTER 5 Investigating DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 CHAPTER 6 Investigating Internet Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-1 CHAPTER 7 Tracking E-Mails and Investigating E-Mail Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-1 CHAPTER 8 Investigating Corporate Espionage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-1 CHAPTER 9 Investigating Trademark and Copyright Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-1 CHAPTER 10 Investigating Sexual Harassment Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10-1 CHAPTER 11 Investigating Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1 INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I-1

iii

This page intentionally left blank

Table of Contents PREFACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii CHAPTER 1 Network Forensics and Investigating Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1 Case Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1 Introduction to Network Forensics and Investigating Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-2 Network Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-2 Analyzing Network Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 The Intrusion Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 Looking for Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3 End-To-End Forensic Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3 Log Files as Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3 Legality of Using Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4 Examining Intrusion and Security Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4 Using Multiple Logs as Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5 Maintaining Credible IIS Log Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5 Importance of Audit Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8 Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-8 Tool: Syslog-ng. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-10 Tool: Socklog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-10 Tool: Kiwi Syslog Daemon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-12 Tool: Microsoft Log Parser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-12 Tool: Firewall Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-13 Tool: Adaptive Security Analyzer (ASA) Pro . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-14 Tool: GFI EventsManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-15 Tool: Activeworx Security Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-17 Linux Process Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-18 Configuring Windows Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-19 Tool: NTsyslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-19 Tool: EventReporter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20 Tool: EventLog Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-20 Why Synchronize Computer Times? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-21 What Is NTP? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-21 Configuring the Windows Time Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-27 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-28 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-28 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-29

CHAPTER 2 Investigating Network Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1 Case Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 Introduction to Investigating Network Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 Network Addressing Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 LAN Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 Internetwork Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 OSI Reference Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3 Overview of Network Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Link Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transport Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Session Layer, Presentation Layer, and Application Layer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2-3 2-4 2-4 2-4 2-4

Overview of Physical and Data Link Layers of the OSI Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5 The Physical Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5 The Data Link Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5

v

vi

Table of Contents Overview of Network and Transport Layers of the OSI Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5 The Network Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5 The Transport Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6 Types of Network Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6 Why Investigate Network Traffic? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6 Evidence Gathering at the Physical Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6 Shared Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6 Switched Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 DNS Poisoning Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Intranet DNS Spoofing (Local Network). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Internet DNS Spoofing (Remote Network) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Proxy Server DNS Poisoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DNS Cache Poisoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2-7 2-8 2-8 2-8 2-8

Evidence Gathering from ARP Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-9 Evidence Gathering at the Data Link Layer: DHCP Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-10 Gathering Evidence from an IDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-10 Tool: Tcpdump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-10 Tool: WinDump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-11 Tool: NetIntercept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-12 Tool: Wireshark . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-13 Tool: CommView . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-14 Tool: SoftPerfect Network Protocol Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-15 Tool: HTTP Sniffer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-16 Tool: EtherDetect Packet Sniffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-18 Tool: OmniPeek . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19 Tool: Iris Network Traffic Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-19 Tool: SmartSniff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-21 Tool: NetSetMan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-21 Tool: Distinct Network Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-23 Tool: MaaTec Network Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-23 Tool: ntop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-24 Tool: EtherApe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-24 Tool: Colasoft Capsa Network Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-24 Tool: Colasoft EtherLook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-26 Tool: AnalogX PacketMon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-26 Tool: BillSniff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-27 Tool: IE HTTP Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-29 Tool: EtherScan Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-29 Tool: Sniphere . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-29 Tool: IP Sniffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-30 Tool: Atelier Web Ports Traffic Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-30 Tool: IPgrab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-32 Tool: Nagios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-33 Tool: Give Me Too . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-33 Tool: Sniff-O-Matic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-33 Tool: EtherSnoop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-35 Tool: GPRS Network Sniffer: Nokia LIG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-35 Tool: Siemens Monitoring Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-36 Tool: NetWitness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-37 Tool: NetResident . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-38 Tool: InfiniStream . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-38 Tool: eTrust Network Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-39

Table of Contents

vii

Tool: ProDiscover Investigator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-41 Tool: P2 Enterprise Shuttle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-41 Tool: Show Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-42 Tool: Network Probe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-43 Tool: Snort Intrusion Detection System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-43 Snort Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-44 Tool: IDS Policy Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-45 Documenting the Evidence Gathered on a Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-45 Evidence Reconstruction for Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-46 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-47 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-47 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-48

CHAPTER 3 Investigating Web Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1 Introduction to Investigating Web Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1 Indications of a Web Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 Types of Web Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 Cross-Site Scripting (XSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 Cross-Site Request Forgery (CSRF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 SQL Injection Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Code Injection Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5 Parameter Tampering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5 Cookie Poisoning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5 Buffer Overflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-6 Cookie Snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-7 DMZ Protocol Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-7 Zero-Day Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-7 Authentication Hijacking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-7 Log Tampering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8 Directory Traversal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9 Cryptographic Interception . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9 URL Interpretation Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9 Impersonation Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10 Overview of Web Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-10 Log Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-10 Log File Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-11 Investigating a Web Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-11 Example of FTP Compromise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-11 Investigating FTP Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-11 Investigating FTP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-12 Investigating IIS Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-12 Investigating Apache Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-12 Investigating Web Attacks in Windows-Based Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-13 Web Page Defacement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-13 Defacement Using DNS Compromise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-14 Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-15 Security Strategies for Web Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-15 Investigating Static and Dynamic IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-16 Checklist for Web Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-16 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-16 Tools for Web Attack Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-16 Analog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-16 Deep Log Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-18

viii

Table of Contents AWStats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Server Log Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WebLog Expert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AlterWind Log Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Webalizer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . eWebLog Analyzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N-Stealth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Acunetix Web Vulnerability Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . dotDefender . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AppScan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AccessDiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Falcove Web Vulnerability Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Emsa Web Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WebWatchBot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Paros . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . HP WebInspect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . keepNI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Wikto . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mapper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N-Stalker Web Application Security Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Scrawlr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Exploit-Me . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3-19 3-20 3-20 3-22 3-22 3-23 3-23 3-24 3-25 3-26 3-26 3-28 3-28 3-29 3-29 3-30 3-31 3-32 3-32 3-33 3-34 3-34

Tools for Locating IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nslookup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . McAfee Visual Trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WHOIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hide Real IP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . www.whatismyip.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IP Detective Suite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enterprise IP-Address Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Whois Lookup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SmartWhois . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ActiveWhois . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . LanWhoIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CountryWhois . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IP2country . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CallerIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Whois.Net . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3-34 3-34 3-36 3-37 3-38 3-40 3-40 3-40 3-42 3-42 3-44 3-44 3-45 3-46 3-46 3-47 3-47

Other Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WebAgain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Pandora FMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . UV Uptime Website Defacement Detector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CounterStorm-1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3-47 3-47 3-49 3-49 3-49

Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-50 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-50 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-51

CHAPTER 4 Router Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Introduction to Router Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Functions of a Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A Router in the OSI Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Router Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Routing Table and Its Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4-2 4-2 4-2 4-3

Router Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Router Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Types of Router Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Router Forensics Versus Traditional Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5 Investigating Router Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-6 Investigation Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-6

Table of Contents

ix

Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-16 Router Audit Tool (RAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-16 Link Logger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-17 Sawmill . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-18 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-18 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-19 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-20

CHAPTER 5 Investigating DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1 Introduction to Investigating DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2 Indications of a DoS/DDoS Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-2 Types of DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ping of Death Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Teardrop Attack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SYN Flooding Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . LAND Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Smurf Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fraggle Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Snork Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . OOB Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Buffer Overflow Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nuke Attack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reflected Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5-2 5-2 5-3 5-3 5-3 5-3 5-3 5-4 5-4 5-4 5-4 5-4

DDoS Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5 Working of a DDoS Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5 Classification of a DDoS Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-5 DoS Attack Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Misuse of Internal Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bandwidth Consumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Consumption of Other Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Destruction or Alteration of Configuration Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5-7 5-7 5-8 5-8 5-8 5-8

Techniques to Detect DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Activity Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sequential Change-Point Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Wavelet-Based Signal Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Monitoring CPU Utilization to Detect DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Detecting DoS Attacks Using Cisco NetFlow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Detecting DoS Attacks Using a Network Intrusion Detection System (NIDS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5-8 5-8 5-8 5-9 5-9 5-9 5-9

Investigating DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-9 ICMP Traceback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-10 Hop-by-Hop IP Traceback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-10 Backscatter Traceback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-11 Hash-Based (Single-Packet) IP Traceback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-13 IP Traceback with IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-13 CenterTrack Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-14 Packet Marking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-14 Check Domain Name System (DNS) Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-14 Tracing with “log-input” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-14 Control Channel Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-14 Correlation and Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15 Path Identification (Pi) Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15 Packet Traffic Monitoring Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15 Tools for Locating IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-15 Challenges in Investigating DoS Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-16 Tool: Nmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-16 Tool: Friendly Pinger. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-16 Tool: IPHost Network Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-17 Tool: Admin’s Server Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-17

x

Table of Contents Tool: Tail4Win . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-18 Tool: Status2k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-19 Tool: DoSHTTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-20 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-20 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-21

CHAPTER 6 Investigating Internet Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1 Case Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1 Introduction to Investigating Internet Crimes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2 Internet Crimes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2 Internet Forensics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4 Why Internet Forensics?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4 Goals of Investigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4 Steps for Investigating Internet Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4 Obtain a Search Warrant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4 Interview the Victim . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5 Prepare Bit-Stream Copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5 Check the Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5 Identify the Source of the Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5 IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-5 Trace the IP Address of the Attacker Computer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-6 Domain Name System (DNS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-6 Analysis of WHOIS Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-9 Collect the Evidence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-15 URL Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-15 Embedded JavaScript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-17 Downloading a Single Page or an Entire Web Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-18 Recovering Information from Web Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-22 Trace the E-Mail Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-22 Tool: NeoTrace (now McAfee Visual Trace) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-25 Tool: NetScan Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-26 Generate a Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-26 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-27 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-28 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-28

CHAPTER 7 Tracking E-Mails and Investigating E-Mail Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-1 Introduction to Tracking E-Mails and Investigating E-Mail Crimes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-2 E-Mail Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-2 E-Mail Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2 E-Mail Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-3 E-Mail Crime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-4 Spamming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-5 Mail Bombing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-6 Mail Storm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-7 Identity Theft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-8 Chain E-Mails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-8 Phishing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-8 E-Mail Spoofing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-8 Investigating E-Mail Crimes and Violations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-8 Obtaining a Search Warrant and Seizing the Computer and E-Mail Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-8 Examining E-Mail Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9

Table of Contents

xi

Copying an E-Mail Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9 Printing an E-Mail Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9 Obtaining a Bit-By-Bit Image of E-Mail Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9 Viewing and Copying E-Mail Headers in Microsoft Outlook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9 Viewing and Copying E-Mail Headers in AOL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-10 Viewing and Copying E-Mail Headers in Hotmail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-10 Viewing and Copying E-Mail Headers in Gmail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-10 Viewing and Copying E-Mail Headers in Yahoo! Mail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-11 Examining an E-Mail Header . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-11 Examining Additional Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-15 Examine the Originating IP Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-16 Examine Phishing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-17 Using Specialized E-Mail Forensic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-17 Tool: Forensic Toolkit (FTK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-19 Tool: FINALeMAIL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-20 Tool: R-Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-20 Tool: E-Mail Detective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-20 Tool: E-mail Examiner by Paraben . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-21 Tool: Network E-mail Examiner by Paraben . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-22 Tool: Recover My Email for Microsoft Outlook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-22 Tool: Diskinternals Outlook Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-22 Trace the E-Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-22 Tool: LoPe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-24 Tool: eMailTrackerPro. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-24 Tool: ID Protect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-26 U.S. Laws against E-Mail Crime: CAN-SPAM Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-26 U.S. Law: 18 U.S.C. § 2252A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-27 U.S. Law: 18 U.S.C. § 2252B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-27 E-Mail Crime Law in Washington: RCW 19.190.020 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-27 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-27 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-28 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-28

CHAPTER 8 Investigating Corporate Espionage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1 Introduction to Investigating Corporate Espionage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1 Motives Behind Spying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-2 Information That Corporate Spies Seek . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-2 Corporate Espionage: Insider/Outsider Threat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3 Corporate Espionage Threat Due to Aggregation of Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3 Techniques of Spying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3 Defense Against Corporate Spying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-4 Steps to Prevent Corporate Espionage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Understand and Prioritize Critical Assets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Define Acceptable Level of Loss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Control Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bait: Honeypots and Honeytokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Detect Moles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Perform Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Perform Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Analyze Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8-5 8-5 8-5 8-5 8-5 8-6 8-6 8-6 8-6

Key Findings from U.S. Secret Service and CERT Coordination Center/SEI Study on Insider Threats. . . . . . . . . . . . . . . . . . . . . . . . . 8-7 Netspionage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-7 Investigating Corporate Espionage Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-7 Tool: Activity Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-8 Tool: Spector CNE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-9 Tool: Track4Win . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-9

xii

Table of Contents Tool: SpyBuddy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-10 Tool: NetVizor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-11 Tool: Privatefirewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-11 Tool: Internet Spy Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-12 Tool: Spybot—Search & Destroy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-12 Tool: SpyCop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-12 Tool: Spyware Terminator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-14 Tool: XoftSpySE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-14 Tool: Spy Sweeper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-14 Tool: CounterSpy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-16 Tool: SUPERAntiSpyware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-17 Tool: iMonitorPC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-17 Guidelines for Writing Employee-Monitoring Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-19 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-20 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-20 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-21

CHAPTER 9 Investigating Trademark and Copyright Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1 Introduction to Investigating Trademark and Copyright Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1 Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2 Trademark Eligibility and Benefits of Registering It . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2 Service Mark and Trade Dress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-2 Trademark Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Monitoring Trademark Infringements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Key Considerations Before Investigating Trademark Infringements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Steps for Investigating Trademark Infringements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9-3 9-8 9-8 9-8

Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-9 Investigating Copyright Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-9 How Long Does a Copyright Last? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-9 U.S. Copyright Office . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-10 How Are Copyrights Enforced? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-10 Plagiarism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-11 Patent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Patent Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Patent Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: http://www.ip.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9-23 9-24 9-24 9-24

Domain Name Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-25 How to Check for Domain Name Infringement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-25 Intellectual Property . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-25 Investigating Intellectual Property Theft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-26 Digital Rights Management (DRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: Windows Media Digital Rights Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: Haihaisoft Media DRM Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: LockLizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tool: IntelliProtector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9-26 9-26 9-28 9-28 9-28

U.S. Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Digital Millennium Copyright Act (DMCA) of 1998 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Lanham (Trademark) Act (15 USC §§ 1051–1127) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Online Copyright Infringement Liability Limitation Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9-30 9-30 9-31 9-32

Indian Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-33 The Patents (Amendment) Act, 1999 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-33 Trade Marks Act, 1999 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-33 Japanese Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-34 Trademark Law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-34 Copyright Management Business Law (4.2.2.3 of 2000) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-35

Table of Contents

xiii

Australian Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-35 The Trade Marks Act 1995 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-35 The Copyright Act 1968: Section 132 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-36 U.K. Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-37 The Copyright, etc. and Trade Marks (Offences and Enforcement) Act 2002 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-37 Trademarks Act 1994 (TMA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-37 Chinese Laws for Trademarks and Copyrights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-38 Copyright Law of People’s Republic of China (Amendments on October 27, 2001) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-38 Trademark Law of the People’s Republic of China (Amendments on October 27, 2001) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-38 Canadian Laws for Trademarks and Copyrights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-38 Copyright Act (R.S., 1985, c. C-42) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-38 Trademark Law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-38 South African Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Trademarks Act 194 of 1993 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Copyright Act of 1978 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Patents Act No. 57 of 1978 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

9-38 9-38 9-38 9-38

South Korean Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Copyright Law Act No. 3916 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Industrial Design Protection Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Belgian Laws for Trademarks and Copyright . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Copyright Law, 30/06/1994 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Trademark Law, 30/06/1969 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Hong Kong Laws for Intellectual Property . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Article 139 of the Basic Law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Article 140 of the Basic Law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-39 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-40 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-40

CHAPTER 10 Investigating Sexual Harassment Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-1 Case Example 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2 Case Example 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2 Case Example 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2 Introduction to Investigating Sexual Harassment Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2 Types of Sexual Harassment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2 Quid Pro Quo Harassment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3 Hostile Work Environment Harassment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-3 Consequences of Sexual Harassment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-4 Sexual Harassment Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-4 The Dos and Don’ts if an Employee Is Being Sexually Harassed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-5 Stalking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stalking Behaviors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Stalking Effects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Guidelines for Stalking Victims . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10-5 10-6 10-6 10-6

Responsibilities of Supervisors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-7 Responsibilities of Employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-7 Complaint Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-7 Investigation Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-8 Sexual Harassment Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-8 Sexual Harassment Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-9 Preventive Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-9 U.S. Laws on Sexual Harassment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10-10 Title VII of the Civil Rights Act of 1964 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-10 The Civil Rights Act of 1991 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-10

xiv

Table of Contents Equal Protection Clause of the 14th Amendment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-11 Common Law Torts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-11 State and Municipal Laws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-11 Australian Laws on Sexual Harassment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10-11 Sex Discrimination Act 1984 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-11 Equal Opportunity for Women in the Workplace Act 1999 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-11 Anti-Discrimination Act 1991 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-11 Workplace Relations Act 1996 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12 Indian Law: Sexual Harassment of Women at Workplace (Prevention, Prohibition, and Redressal) Bill, 2006 . . . . . . . . . . . . . . . . 10-12 German Law: Protection of Employees Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12 U.K. Law: The Employment Equality (Sex Discrimination) Regulations 2005 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12 Law of the People’s Republic of China on the Protection of Rights and Interests of Women . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12 Malaysian Penal Code, Section 509 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12 Sample Complaint Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-12 Laws against Stalking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-15 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-15 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-15 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10-16

CHAPTER 11 Investigating Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-1 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-1 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-1 Introduction to Investigating Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-2 People’s Motives Behind Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-2 People Involved in Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-2 Role of the Internet in Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-3 Effects of Child Pornography on Children . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-3 Measures to Prevent Dissemination of Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-3 Computer Industry Self-Regulation (Role of ISP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-3 Legislative Regulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-3 Citizens’ Committee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-3 Parental Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Law Enforcement Responses (Role of Police) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Challenges in Controlling Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Precautions Before Investigating Child Pornography Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Steps for Investigating Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-4 Step 1: Search and Seize All Computers and Media Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-5 Step 2: Check Authenticated Login Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-5 Step 3: Search Hard Disks for Pornographic Material. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-5 Step 4: Recover Deleted Files and Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-5 Step 5: Check Metadata of Files and Folders Related to Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-5 Step 6: Check and Recover Browser Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-7 Step 7: Check ISP Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-11 Sources of Digital Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-11 Citizens’ Responsibility in Fighting Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-11 Guidelines to Avoid Child Pornography on the Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-11 Guidelines for Parents to Reduce the Risk of Their Children Being Exposed to Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . .11-12 Tool: Reveal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-12 Tool: iProtectYou . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-12 Tool: Web Control for Parents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-13 Tool: BrowseControl. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-15 Tool: ChatGuard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-15 Tool: Child Exploitation Tracking System (CETS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-17 Child Pornography Legislation Survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-17

Table of Contents

xv

U.S. Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-22 § 18 U.S.C. 1466A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-22 § 18 U.S.C. 2251 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 § 18 U.S.C. 2252 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 § 42 U.S.C. 13032 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 State Laws: Michigan Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Australian Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Criminal Code Act 1995 Section 474.19 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Criminal Code Act 1995 Section 474.20 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Austrian Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Belgian Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Article 383bis of the Penal Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Article 380ter of the Penal Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-23 Cypriot Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-24 The Convention on Cybercrime, Law 22(III)/2004 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-24 Combating Trafficking in Human Beings and Sexual Abuse of Minors Law 3(1)/2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-24 Japanese Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-24 South African Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-24 Child Care Amendment Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-24 Amendment of Section 2 of Act 65 of 1996. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-24 Amendment of Section 27 of Act 65 of 1996 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 U.K. Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 15 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 17 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 18 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 19 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 47 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 48 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 49 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Section 50 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 English and Welsh Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Scottish Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-25 Philippine Laws Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-26 Children’s Internet Protection Act (CIPA). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-26 Anti-Child-Pornography Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-26 Project Safe Childhood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-27 Innocent Images National Initiative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-27 Internet Crimes Against Children . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-28 Anti-Child Porn Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-28 Child Exploitation and Online Protection Centre . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-29 Think U Know . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-29 Virtual Global Taskforce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-30 Internet Watch Foundation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-31 International Centre for Missing & Exploited Children . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-31 National Center for Missing & Exploited Children . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-33 Financial Coalition Against Child Pornography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-33 Perverted Justice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-35 National Society for the Prevention of Cruelty to Children . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-35 Canadian Centre for Child Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-35 Cybertip.ca. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-36 Association of Sites Advocating Child Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-37 Web Sites Against Child Porn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-37 Report Child Porn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-37 Child Focus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-37 StopChildPorno.be. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-39 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-39 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-40 Hands-On Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-41

INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .I-1

This page intentionally left blank

Preface Hacking and electronic crimes sophistication has grown at an exponential rate in recent years. In fact, recent reports have indicated[CC1] that cyber crime already surpasses the illegal drug trade! Unethical hackers, better known as black hats, are preying on information systems of government, corporate, public, and private networks and are constantly testing the security mechanisms of these organizations to the limit with the sole aim of exploiting them and profiting from the exercise. High-profile crimes have proven that the traditional approach to computer security is simply not sufficient, even with the strongest perimeter, properly configured defense mechanisms such as firewalls, intrusion detection, and prevention systems, strong end-to-end encryption standards, and anti-virus software. Hackers have proven their dedication and ability to systematically penetrate networks all over the world. In some cases, black hats may be able to execute attacks so flawlessly that they can compromise a system, steal everything of value, and completely erase their tracks in less than 20 minutes! The EC-Council Press is dedicated to stopping hackers in their tracks.

About EC-Council The International Council of Electronic Commerce Consultants, better known as EC-Council, was founded in late 2001 to address the need for well-educated and certified information security and e-business practitioners. EC-Council is a global, member-based organization comprised of industry and subject matter experts all working together to set the standards and raise the bar in information security certification and education. EC-Council first developed the Certified Ethical Hacker (C|EH) program. The goal of this program is to teach the methodologies, tools, and techniques used by hackers. Leveraging the collective knowledge from hundreds of subject matter experts, the C|EH program has rapidly gained popularity around the globe and is now delivered in more than 70 countries by more than 450 authorized training centers. More than 60,000 information security practitioners have been trained. C|EH is the benchmark for many government entities and major corporations around the world. Shortly after C|EH was launched, EC-Council developed the Certified Security Analyst (E|CSA). The goal of the E|CSA program is to teach groundbreaking analysis methods that must be applied while conducting advanced penetration testing. The E|CSA program leads to the Licensed Penetration Tester (L|PT) status. The Computer Hacking Forensic Investigator (C|HFI) was formed with the same design methodologies and has become a global standard in certification for computer forensics. EC-Council, through its impervious network of professionals and huge industry following, has developed various other programs in information security and e-business. EC-Council certifications are viewed as the essential certifications needed when standard configuration and security policy courses fall short. Providing a true, hands-on, tactical approach to security, individuals armed with the knowledge disseminated by EC-Council programs are securing networks around the world and beating the hackers at their own game.

About the EC-Council | Press The EC-Council | Press was formed in late 2008 as a result of a cutting-edge partnership between global information security certification leader, EC-Council and leading global academic publisher, Cengage Learning. This partnership marks a revolution in academic textbooks and courses of study in information security, computer forensics, disaster recovery, and end-user security. By identifying the essential topics and content of EC-Council professional certification programs, and repurposing this world-class content to fit academic programs, the EC-Council | Press was formed. The academic community is now able to incorporate this powerful cutting-edge content into new and existing Information Security programs. By closing the gap between academic study and professional certification, students and instructors are able to leverage the power of rigorous academic focus and high demand industry certification. The EC-Council | Press is set to revolutionize global information security programs and ultimately create a new breed of practitioners capable of combating the growing epidemic of cybercrime and the rising threat of cyber-war.

xvii

xviii

Preface

Computer Forensics Series The EC-Council | Press Computer Forensics Series, preparing learners for C|HFI certification, is intended for those studying to become police investigators and other law enforcement personnel, defense and military personnel, e-business security professionals, systems administrators, legal professionals, banking, insurance and other professionals, government agencies, and IT managers. The content of this program is designed to expose the learner to the process of detecting attacks and collecting evidence in a forensically sound manner with the intent to report crime and prevent future attacks. Advanced techniques in computer investigation and analysis with interest in generating potential legal evidence are included. In full, this series prepares the learner to identify evidence in computer-related crime and abuse cases as well as track the intrusive hacker’s path through client system. Books in Series • Computer Forensics: Investigation Procedures and Response/1435483499 • Computer Forensics: Investigating Hard Disks, File and Operating Systems/1435483502 • Computer Forensics: Investigating Data and Image Files/1435483510 • Computer Forensics: Investigating Network Intrusions and Cybercrime/1435483529 • Computer Forensics: Investigating Wireless Networks and Devices/1435483537

Network Intrusions and Cybercrime Network Intrusions and Cybercrime includes a discussion of tools used in investigations as well as information on investigating network traffic, Web attacks, DOS attacks, corporate espionage, and much more!

Chapter Contents Chapter 1, Network Forensics and Investigating Logs, discusses how to look for evidence, the different logs used in investigating, and a discussion of NTP. Chapter 2, Investigating Network Traffic, explains basic networking concepts, the ways that an intruder can attack a network, and how an investigator gathers evidence and what tools can be used. Chapter 3, Investigating Web Attacks, covers how to recognize and investigate attacks, what tools attackers use, and how to proactively defend against attacks. Chapter 4, Router Forensics, discusses router architecture, the different types of router attackers and how to investigate them, and introduces various router auditing tools. Chapter 5, Investigating DoS Attacks, provides an understanding of DoS attacks, how to recognize the indication of DoS/DDoS attacks, and how to investigate these attacks. Chapter 6, Investigating Internet Crime, describes the different forensic methods and tools investigators use when investigating Internet crimes. Chapter 7, Tracking E-Mails and Investigating E-Mail Crime, focuses on the different parts of an e-mail system and the different kinds of e-mail crimes. Chapter 8, Investigating Corporate Espionage, discusses the different aspects of corporate espionage and strategies to prevent and investigate such cases. Chapter 9, Investigating Trademark and Copyright Infringement, explains what constitutes infringement and how that infringement can be investigated. Chapter 10, Investigating Sexual Harassment Incidents, explains sexual harassment, how to investigate and prevent it, and includes laws concerning sexual harassment. Chapter 11, Investigating Child Pornography, defines child pornography and discusses the role of the Internet in promoting child pornography. This chapter also enumerates the steps for investigating child pornography cases as well as a discussion on child pornography laws.

Chapter Features Many features are included in each chapter and all are designed to enhance the learner’s learning experience. Features include: • Objectives begin each chapter and focus the learner on the most important concepts in the chapter. • Key Terms are designed to familiarize the learner with terms that will be used within the chapter. • Case Examples, found throughout the chapter, present short scenarios followed by questions that challenge the learner to arrive at an answer or solution to the problem presented. • Chapter Summary, at the end of each chapter, serves as a review of the key concepts covered in the chapter.

How to Become C|HFI Certified

xix

• Review Questions allow learners to test their comprehension of the chapter content. • Hands-On Projects encourage learners to apply the knowledge they have gained after finishing the chapter. Files for the Hands-On Projects can be found on the Student Resource Center. Note: You will need your access code provided in your book to enter the site. Visit www.cengage.com/community/eccouncil for a link to the Student Resource Center.

Student Resource Center The Student Resource Center contains all the files you need to complete the Hands-On Projects found at the end of the chapters. Access the Student Resource Center with the access code provided in your book. Visit www.cengage.com/community/eccouncil for a link to the Student Resource Center.

Additional Instructor Resources Free to all instructors who adopt the Investigating Network Intrusions and Cybercrime book for their courses is a complete package of instructor resources. These resources are available from the Course Technology Web site, www.cengage.com/coursetechnology, by going to the product page for this book in the online catalog, and choosing “Instructor Downloads.” Resources include: • Instructor Manual: This manual includes course objectives and additional information to help your instruction. • ExamView Testbank: This Windows-based testing software helps instructors design and administer tests and pre-tests. In addition to generating tests that can be printed and administered, this fullfeatured program has an online testing component that allows students to take tests at the computer and have their exams automatically graded. • PowerPoint Presentations: This book comes with a set of Microsoft PowerPoint slides for each chapter. These slides are meant to be used as teaching aids for classroom presentations, to be made available to students for chapter review, or to be printed for classroom distribution. Instructors are also at liberty to add their own slides. • Labs: These are additional hands-on sctivities to provide more practice for your students. • Assessment Activities: These are additional assessment opportunities including discussion questions, writing assignments, Internet research activities, and homework assignments along with a final cumulative project. • Final Exam: This exam provides a comprehensive assessment of Investigating Network Intrusions and Cybercrime content.

Cengage Learning Information Security Community Site Cengage Learning Information Security Community Site was created for learners and instructors to find out about the latest in information security news and technology. Visit community.cengage.com/infosec to: • Learn what’s new in information security through live news feeds, videos and podcasts; • Connect with your peers and security experts through blogs and forums; • Browse our online catalog.

How to Become C|HFI Certified Today’s battles between corporations, governments, and countries are no longer fought only in the typical arenas of boardrooms or battlefields using physical force. Now the battlefield starts in the technical realm, which ties into most every facet of modern day life. The C|HFI certification focuses on the necessary skills to identify an intruder’s footprints and to properly gather the necessary evidence to prosecute. The C|HFI certification is primarily targeted at police and other law enforcement personnel, defense and military personnel, e-business

xx

Preface

security professionals, systems administrators, legal professionals, banking, insurance and other professionals, government agencies, and IT managers. This certification will ensure that you have the knowledge and skills to identify, track, and prosecute the cyber-criminal. C|HFI Certification exams are available through authorized Prometric testing centers. To finalize your certification after your training by taking the certification exam through a Prometric testing center, you must: 1. Apply for and purchase an exam voucher by visiting the EC-Council Press community site: www.cengage.com/community/eccouncil, if one was not purchased with your book. 2. Once you have your exam voucher, visit www.prometric.com and schedule your exam, using the information on your voucher. 3. Take and pass the C|HFI certification examination with a score of 70% or better. C|HFI certification exams are also available through Prometric Prime. To finalize your certification after your training by taking the certification exam through Prometric Prime, you must: 1. Purchase an exam voucher by visiting the EC-Council Press community site: www.cengage.com/community/eccouncil, if one was not purchased with your book. 2. Speak with your instructor about scheduling an exam session, or visit the EC-Council community site referenced above for more information. 3. Take and pass the C|HFI certification examination with a score of 70% or better.

About Our Other EC-Council | Press Products Ethical Hacking and Countermeasures Series The EC-Council | Press Ethical Hacking and Countermeasures series is intended for those studying to become security officers, auditors, security professionals, site administrators, and anyone who is concerned about or responsible for the integrity of the network infrastructure. The series includes a broad base of topics in offensive network security, ethical hacking, as well as network defense and countermeasures. The content of this series is designed to immerse learners into an interactive environment where they will be shown how to scan, test, hack, and secure information systems. A wide variety of tools, viruses, and malware is presented in these books, providing a complete understanding of the tactics and tools used by hackers. By gaining a thorough understanding of how hackers operate, ethical hackers are able to set up strong countermeasures and defensive systems to protect their organizations’ critical infrastructure and information. The series, when used in its entirety, helps prepare readers to take and succeed on the C|EH certification exam from EC-Council. Books in Series • Ethical Hacking and Countermeasures: Attack Phases/143548360X • Ethical Hacking and Countermeasures: Threats and Defense Mechanisms/1435483618 • Ethical Hacking and Countermeasures: Web Applications and Data Servers/1435483626 • Ethical Hacking and Countermeasures: Linux, Macintosh and Mobile Systems/1435483642 • Ethical Hacking and Countermeasures: Secure Network Infrastructures/1435483650

Network Security Administrator Series The EC-Council | Press Network Administrator series, preparing learners for E|NSA certification, is intended for those studying to become system administrators, network administrators and anyone who is interested in network security technologies. This series is designed to educate learners, from a vendor neutral standpoint, how to defend the networks they manage. This series covers the fundamental skills in evaluating internal and external threats to network security, design, and how to enforce network level security policies, and ultimately protect an organization’s information. Covering a broad range of topics from secure network fundamentals, protocols and analysis, standards and policy, hardening infrastructure, to configuring IPS, IDS and firewalls, bastion host and honeypots, among many other topics, learners completing this series will have a full understanding of defensive measures taken to secure their organizations information. The series, when used in its entirety, helps prepare readers to take and succeed on the E|NSA, Network Security Administrator certification exam from EC-Council.

About Our Other EC-Council | Press Products

xxi

Books in Series • Network Defense: Fundamentals and Protocols/1435483553 • Network Defense: Security Policy and Threats/1435483561 • Network Defense: Perimeter Defense Mechanisms/143548357X • Network Defense: Securing and Troubleshooting Network Operating Systems/1435483588 • Network Defense: Security and Vulnerability Assessment/1435483596

Security Analyst Series The EC-Council | Press Security Analyst/Licensed Penetration Tester series, preparing learners for E|CSA/LPT certification, is intended for those studying to become network server administrators, firewall administrators, security testers, system administrators and risk assessment professionals. This series covers a broad base of topics in advanced penetration testing and security analysis. The content of this program is designed to expose the learner to groundbreaking methodologies in conducting thorough security analysis, as well as advanced penetration testing techniques. Armed with the knowledge from the Security Analyst series, learners will be able to perform the intensive assessments required to effectively identify and mitigate risks to the security of the organizations’ infrastructure. The series, when used in its entirety, helps prepare readers to take and succeed on the E|CSA, Certified Security Analyst, and L|PT, License Penetration Tester certification exam from EC-Council. Books in Series • Certified Security Analyst: Security Analysis and Advanced Tools/1435483669 • Certified Security Analyst: Customer Agreements and Reporting Procedures in Security Analysis/1435483677 • Certified Security Analyst: Penetration Testing Methodologies in Security Analysis/1435483685 • Certified Security Analyst: Network and Communication Testing Procedures in Security Analysis/1435483693 • Certified Security Analyst: Network Threat Testing Procedures in Security Analysis/1435483707

Cyber Safety/1435483715 Cyber Safety is designed for anyone who is interested in learning computer networking and security basics. This product provides information cyber crime; security procedures; how to recognize security threats and attacks, incident response, and how to secure Internet access. This book gives individuals the basic security literacy skills to begin high-end IT programs. The book also prepares readers to take and succeed on the Security|5 certification exam from EC-Council.

Wireless Safety/1435483766 Wireless Safety introduces the learner to the basics of wireless technologies and its practical adaptation. Wireless|5 is tailored to cater to any individual’s desire to learn more about wireless technology. It requires no pre-requisite knowledge and aims to educate the learner in simple applications of these technologies. Topics include wireless signal propagation, IEEE and ETSI wireless standards, WLANs and operation, wireless protocols and communication languages, wireless devices, and wireless security networks. The book also prepares readers to take and succeed on the Wireless|5 certification exam from EC-Council.

Network Safety/1435483774 Network Safety provides the basic core knowledge on how infrastructure enables a working environment. It is intended for those in office environments and home users who want to optimize resource utilization, share infrastructure, and make the best of technology and the convenience it offers. Topics include foundations of networks, networking components, wireless networks, basic hardware components, the networking environment and connectivity as well as troubleshooting. The book also prepares readers to take and succeed on the Network|5 certification exam from EC-Council.

Disaster Recovery Professional The Disaster Recovery Professional series, preparing the reader for E|DRP certification, introduces the learner to the methods employed in identifying vulnerabilities and how to take the appropriate countermeasures to prevent and mitigate failure risks for an organization. It also provides a foundation in disaster recovery principles, including preparation of a disaster recovery plan, assessment of risks in the enterprise, development of policies, and procedures, and understanding of the roles and relationships of various members of an organization,

xxii

Preface

implementation of the plan, and recovering from a disaster. Students will learn how to create a secure network by putting policies and procedures in place, and how to restore a network in the event of a disaster. The series, when used in its entirety, helps prepare readers to take and succeed on the E|DRP, Disaster Recovery Professional certification exam from EC-Council. Books in Series • Disaster Recovery/1435488709 • Business Continuity/1435488695

Acknowledgements Michael H. Goldner is the Chair of the School of Information Technology for ITT Technical Institute in Norfolk Virginia, and also teaches bachelor level courses in computer network and information security systems. Michael has served on and chaired ITT Educational Services Inc. National Curriculum Committee on Information Security. He received his Juris Doctorate from Stetson University College of Law, his undergraduate degree from Miami University and has been working for more than 15 years in the area of information technology. He is an active member of the American Bar Association, and has served on that organization’s cyber law committee. He is a member of IEEE, ACM, and ISSA, and is the holder of a number of industrially recognized certifications including, CISSP, CEH, CHFI, CEI, MCT, MCSE/Security, Security ⫹, Network ⫹, and A⫹. Michael recently completed the design and creation of a computer forensic program for ITT Technical Institute, and has worked closely with both EC-Council and Delmar/Cengage Learning in the creation of this EC-Council Press series.

xxiii

This page intentionally left blank

1

Chapter

Network Forensics and Investigating Logs

Objectives After completing this chapter, you should be able to: • • • • • • • • •

Look for evidence Perform an end-to-end forensic investigation Use log files as evidence Evaluate log file accuracy and authenticity Understand the importance of audit logs Understand syslog Understand Linux process accounting Configure Windows logging Understand NTP

Key Terms Intrusion detection the process of tracking unauthorized activity using techniques such as

inspecting user actions, security logs, or audit data Network Time Protocol (NTP) an Internet standard protocol that is used to synchronize the clocks of client computers

Case Example In August 2005, a Moroccan named Farid Essebar and a Turk named Atilla Ekici were arrested in their respective home countries on the charges of creating and distributing the Zotob, Rbot, and Mytob worms. It is believed that Essebar wrote the worm code, and Ekici offered him financial support. The Mytob worm affected a wide range of Windows systems, including Windows NT, 2000, XP, and Server 2003. The Zotob worm affected the systems of corporate giants, such as the New York Times Company, CNN, ABC News, Caterpillar Inc., and General Electric Co. 1-1

1-2

Chapter 1

Within 12 days of the release of the worms, the culprits were arrested. This was possible because of extensive cooperation between Microsoft, the FBI, and the Turkish and Moroccan authorities. It is noteworthy that the investigations crossed international boundaries. It is still unclear whether any other individual or organization was involved in this crime. The United States did not seek extradition of the culprits, as the cyber law differs from country to country. The culprits have been prosecuted in their respective home countries.

Introduction to Network Forensics and Investigating Logs This chapter focuses on network forensics and investigating logs. It starts by defining network forensics and describing the tasks associated with a forensic investigation. The chapter then covers log files and their use as evidence. The chapter concludes with a discussion about time synchronization.

Network Forensics Network forensics is the capturing, recording, and analysis of network events in order to discover the source of security attacks. Capturing network traffic over a network is simple in theory, but relatively complex in practice. This is because of the large amount of data that flows through a network and the complex nature of Internet protocols. Because recording network traffic involves a lot of resources, it is often not possible to record all of the data flowing through the network. An investigator needs to back up these recorded data to free up recording media and to preserve the data for future analysis.

Analyzing Network Data The analysis of recorded data is the most critical and most time-consuming task. Although there are many automated analysis tools that an investigator can use for forensic purposes, they are not sufficient, as there is no foolproof method for discriminating bogus traffic generated by an attacker from genuine traffic. Human judgment is also critical because with automated traffic analysis tools, there is always a chance of a false positive. An investigator needs to perform network forensics to determine the type of an attack over a network and to trace out the culprit. The investigator needs to follow proper investigative procedures so that the evidences recovered during investigation can be produced in a court of law. Network forensics can reveal the following information: • How an intruder entered the network • The path of intrusion • The intrusion techniques an attacker used • Traces and evidence Network forensics investigators cannot do the following: • Solve the case alone • Link a suspect to an attack

The Intrusion Process Network intruders can enter a system using the following methods: • Enumeration: Enumeration is the process of gathering information about a network that may help an intruder attack the network. Enumeration is generally carried out over the Internet. The following information is collected during enumeration: • Topology of the network • List of live hosts • Network architecture and types of traffic (for example, TCP, UDP, and IPX) • Potential vulnerabilities in host systems • Vulnerabilities: An attacker identifies potential weaknesses in a system, network, and elements of the network and then tries to take advantage of those vulnerabilities. The intruder can find known vulnerabilities using various scanners.

Log Files as Evidence

1-3

• Viruses: Viruses are a major cause of shutdown of network components. A virus is a software program written to change the behavior of a computer or other device on a network, without the permission or knowledge of the user. • Trojans: Trojan horses are programs that contain or install malicious programs on targeted systems. These programs serve as back doors and are often used to steal information from systems. • E-mail infection: The use of e-mail to attack a network is increasing. An attacker can use e-mail spamming and other means to flood a network and cause a denial-of-service attack. • Router attacks: Routers are the main gateways into a network, through which all traffic passes. A router attack can bring down a whole network. • Password cracking: Password cracking is a last resort for any kind of attack.

Looking for Evidence An investigator can find evidence from the following: • From the attack computer and intermediate computers: This evidence is in the form of logs, files, ambient data, and tools. • From firewalls: An investigator can look at a firewall’s logs. If the firewall itself was the victim, the investigator treats the firewall like any other device when obtaining evidence. • From internetworking devices: Evidence exists in logs and buffers as available. • From the victim computer: An investigator can find evidence in logs, files, ambient data, altered configuration files, remnants of Trojaned files, files that do not match hash sets, tools, Trojans and viruses, stored stolen files, Web defacement remnants, and unknown file extensions.

End-To-End Forensic Investigation An end-to-end forensic investigation involves following basic procedures from beginning to end. The following are some of the elements of an end-to-end forensic trace: • The end-to-end concept: An end-to-end investigation tracks all elements of an attack, including how the attack began, what intermediate devices were used during the attack, and who was attacked. • Locating evidence: Once an investigator knows what devices were used during the attack, he or she can search for evidence on those devices. The investigator can then analyze that evidence to learn more about the attack and the attacker. • Pitfalls of network evidence collection: Evidence can be lost in a few seconds during log analysis because logs change rapidly. Sometimes, permission is required to obtain evidence from certain sources, such as ISPs. This process can take time, which increases the chances of evidence loss. Other pitfalls include the following: • An investigator or network administrator may mistake normal computer or network activity for attack activity. • There may be gaps in the chain of evidence. • Logs may be ambiguous, incomplete, or missing. • Since the Internet spans the globe, other nations may be involved in the investigation. This can create legal and political issues for the investigation. • Event analysis: After an investigator examines all of the information, he or she correlates all of the events and all of the data from the various sources to get the whole picture.

Log Files as Evidence Log files are the primary recorders of a user’s activity on a system and of network activities. An investigator can both recover any services altered and discover the source of illicit activities using logs. Logs provide clues to investigate. The basic problem with logs is that they can be altered easily. An attacker can easily insert false entries into log files.

1-4

Chapter 1

An investigator must be able to prove in court that logging software is correct. Computer records are not normally admissible as evidence; they must meet certain criteria to be admitted at all. The prosecution must present appropriate testimony to show that logs are accurate, reliable, and fully intact. A witness must authenticate computer records presented as evidence.

Legality of Using Logs The following are some of the legal issues involved with creating and using logs that organizations and investigators must keep in mind: • Logs must be created reasonably contemporaneously with the event under investigation. • Log files cannot be tampered with. • Someone with knowledge of the event must record the information. In this case, a program is doing the recording; the record therefore reflects the a priori knowledge of the programmer and system administrator. • Logs must be kept as a regular business practice. • Random compilations of data are not admissible. • Logs instituted after an incident has commenced do not qualify under the business records exception; they do not reflect the customary practice of an organization. • If an organization starts keeping regular logs now, it will be able to use the logs as evidence later. • A custodian or other qualified witness must testify to the accuracy and integrity of the logs. This process is known as authentication. The custodian need not be the programmer who wrote the logging software; however, he or she must be able to offer testimony on what sort of system is used, where the relevant software came from, and how and when the records are produced. • A custodian or other qualified witness must also offer testimony as to the reliability and integrity of the hardware and software platform used, including the logging software. • A record of failures or of security breaches on the machine creating the logs will tend to impeach the evidence. • If an investigator claims that a machine has been penetrated, log entries from after that point are inherently suspect. • In a civil lawsuit against alleged hackers, anything in an organization’s own records that would tend to exculpate the defendants can be used against the organization. • An organization’s own logging and monitoring software must be made available to the court so that the defense has an opportunity to examine the credibility of the records. If an organization can show that the relevant programs are trade secrets, the organization may be allowed to keep them secret or to disclose them to the defense only under a confidentiality order. • The original copies of any log files are preferred. • A printout of a disk or tape record is considered to be an original copy, unless and until judges and jurors are equipped computers that have USB or SCSI interfaces.

Examining Intrusion and Security Events As discussed earlier, the inspection of log files can reveal an intrusion or attack on a system. Therefore, monitoring for intrusion and security breach events is necessary to track down attackers. Examining intrusion and security events includes both passive and active tasks. A detection of an intrusion that occurs after an attack has taken place is called a post-attack detection or passive intrusion detection. In these cases, the inspection of log files is the only medium that can be used to evaluate and rebuild the attack techniques. Passive intrusion detection techniques usually involve a manual review of event logs and application logs. An investigator can inspect and analyze event log data to detect attack patterns. On the other hand, there are many attack attempts that can be detected as soon as the attack takes place. This type of detection is known as active intrusion detection. Using this method, an administrator or investigator follows the footsteps of the attacker and looks for known attack patterns or commands, and blocks the execution of those commands.

Log Files as Evidence

1-5

Intrusion detection is the process of tracking unauthorized activity using techniques such as inspecting user actions, security logs, or audit data. There are various types of intrusions, including unauthorized access to files and systems, worms, Trojans, computer viruses, buffer overflow attacks, application redirection, and identity and data spoofing. Intrusion attacks can also appear in the form of denial of service, and DNS, e-mail, content, or data corruption. Intrusions can result in a change of user and file security rights, installation of Trojan files, and improper data access. Administrators use many different intrusion detection techniques, including evaluation of system logs and settings, and deploying firewalls, antivirus software, and specialized intrusion detection systems. Administrators should investigate any unauthorized or malicious entry into a network or host.

Using Multiple Logs as Evidence Recording the same information in two different devices makes the evidence stronger. Logs from several devices collectively support each other. Firewall logs, IDS logs, and TCPDump output can contain evidence of an Internet user connecting to a specific server at a given time.

Maintaining Credible IIS Log Files Many network administrators have faced serious Web server attacks that have become legal issues. Web attacks are generally traced using IIS logs. Investigators must ask themselves certain questions before presenting IIS logs in court, including: • What would happen if the credibility of the IIS logs was challenged in court? • What if the defense claims the logs are not reliable enough to be admissible as evidence? An investigator must secure the evidence and ensure that it is accurate, authentic, and accessible. In order to prove that the log files are valid, the investigator needs to present them as acceptable and dependable by providing convincing arguments, which makes them valid evidence.

Log File Accuracy The accuracy of IIS log files determines their credibility. Accuracy here means that the log files presented before the court of law represent the actual outcome of the activities related to the IIS server being investigated. Any modification to the logs causes the validity of the entire log file being presented to be suspect.

Logging Everything In order to ensure that a log file is accurate, a network administrator must log everything. Certain fields in IIS log files might seem to be less significant, but every field can make a major contribution as evidence. Therefore, network administrators should configure their IIS server logs to record every field available. IIS logs must record information about Web users so that the logs provide clues about whether an attack came from a logged-in user or from another system. Consider a defendant who claims a hacker had attacked his system and installed a back-door proxy server on his computer. The attacker then used the back-door proxy to attack other systems. In such a case, how does an investigator prove that the traffic came from a specific user’s Web browser or that it was a proxied attack from someone else?

Extended Logging in IIS Server Limited logging is set globally by default, so any new Web sites created have the same limited logging. An administrator can change the configuration of an IIS server to use extended logging. The following steps explain how to enable extended logging for an IIS Web/FTP server and change the location of log files: 1. Run the Internet Services Manager. 2. Select the properties on the Web/FTP server. 3. Select the Web site or FTP site tab. 4. Check the Enable Logging check box. 5. Select W3C Extended Log File Format from the drop-down list. 6. Go to Properties.

1-6

Chapter 1

7. Click the Extended Properties tab, and set the following properties accordingly: • Client IP address • User name • Method • URI stem • HTTP status • Win32 status • User agent • Server IP address • Server port 8. Select Daily for New Log Time Period below the general Properties tab. 9. Select Use local time for file naming and overturn. 10. Change the log file directory to the location of logs. 11. Ensure that the NTFS security settings have the following settings: • Administrators - Full Control • System - Full Control

Keeping Time

With the Windows time service, a network administrator can synchronize IIS servers by connecting them to an external time source. Using a domain makes the time service synchronous to the domain controller. A network administrator can synchronize a standalone server to an external time source by setting certain registry entries: Key: HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\ Setting: Type Type: REG_SZ Value: NTP Key: HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters\ Setting: NtpServer Type: REG_SZ Value: ntp.xsecurity.com

UTC Time IIS records logs using UTC time, which helps in synchronizing servers in multiple zones. Windows offsets the value of the system clock with the system time zone to calculate UTC time. To check whether the UTC time is correct, a network administrator must ensure that the local time zone setting is accurate. The network administrator must verify that during the process IIS is set to roll over logs using local time. A network administrator can verify a server’s time zone setting by looking at the first entries in the log file. If the server is set at UTC –06:00, then the first log entries should appear around 18:00 (00:00 – 06:00 = 18:00). Because UTC does not follow daylight savings, the administrator must also consider the date. For example, UTC –6:00 will actually be –5:00 half the year.

Log Files as Evidence

1-7

Avoiding Missing Logs When an IIS server is offline or powered off, log files are not created. When a log file is missing, it is difficult to know if the server was actually offline or powered off, or if the log file was deleted. To combat this problem, an administrator can schedule a few hits to the server using a scheduling tool. The administrator can keep a log of the outcomes of these hits to determine when the server was active. If the record of hits shows that the server was online and active at the time that log file data is missing, the administrator knows that the missing log file might have been deleted.

Log File Authenticity An investigator can prove that log files are authentic if he or she can prove that the files have not been altered since they were originally recorded. IIS log files are simple text files that are easy to alter. The date and time stamps on these files are also easy to modify. Hence, they cannot be considered authentic in their default state. If a server has been compromised, the investigator should move the logs off the server. The logs should be moved to a master server and then moved offline to secondary storage media such as a tape or CD-ROM.

Working with Copies As with all forensic investigation, an investigator should never work with the original files when analyzing log files. The investigator should create copies before performing any postprocessing or log file analysis. If the original files are not altered, the investigator can more easily prove that they are authentic and are in their original form. When using log files as evidence in court, an investigator is required to present the original files in their original form.

Access Control In order to prove the credibility of logs, an investigator or network administrator needs to ensure that any access to those files is audited. The investigator or administrator can use NTFS permissions to secure and audit the log files. IIS needs to be able to write to log files when the logs are open, but no one else should have access to write to these files. Once a log file is closed, no one should have access to modify the contents of the file.

Chain of Custody As with all forensic evidence, the chain of custody must be maintained for log files. As long as the chain of custody is maintained, an investigator can prove that the log file has not been altered or modified since its capture. When an investigator or network administrator moves log files from a server, and after that to an offline device, he or she should keep track of where the log file went and what other devices it passed through. This can be done with either technical or nontechnical methods, such as MD5 authentication.

IIS Centralized Binary Logging Centralized binary logging is a process in which many Web sites write binary and unformatted log data to a single log file. An administrator needs to use a parsing tool to view and analyze the data. The files have the extension .ibl, which stands for Internet binary log. It is a server property, so all Web sites on that server write log data to the central log file. It decreases the amount of system resources that are consumed during logging, therefore increasing performance and scalability. The following are the fields that are included in the centralized binary log file format: • Date • Time • Client IP address • User name • Site ID • Server name • Server IP address • Server port

1-8

Chapter 1

• Method • URI stem • URI query • Protocol status • Windows status • Bytes sent • Bytes received • Time taken • Protocol version • Protocol substatus

ODBC Logging ODBC logging records a set of data fields in an ODBC-compliant database like Microsoft Access or Microsoft SQL Server. The administrator sets up and specifies the database to receive the data and log files. When ODBC logging is enabled, IIS disables the HTTP.sys kernel-mode cache. An administrator must be aware that implementing ODBC logging degrades server performance. Some of the information that is logged includes the IP address of the user, user name, date, time, HTTP status code, bytes received, bytes sent, action carried out, and target file.

Tool: IISLogger IISLogger provides additional functionality on top of standard IIS logging. It produces additional log data and sends it using syslog. It even logs data concerning aborted Web requests that were not completely processed by IIS. IISLogger is an ISAPI filter that is packaged as a DLL embedded in the IIS environment. It starts automatically with IIS. When IIS triggers an ISAPI filter notification, IISLogger prepares header information and logs this information to syslog in a certain format. This occurs each time, for every notification IISLogger is configured to handle. The following are some of the features of IISLogger: • It generates additional log information beyond what is provided by IIS. • It recognizes hacker attacks. • It forwards IIS log data to syslog. • It provides a GUI for configuration purposes. Figure 1-1 shows a screenshot from IISLogger.

Importance of Audit Logs The following are some of the reasons audit logs are important: • Accountability: Log data identifies the accounts that are associated with certain events. This data highlights where training and disciplinary actions are needed. • Reconstruction: Investigators review log data in order of time to determine what happened before and during an event. • Intrusion detection: Investigators review log data to identify unauthorized or unusual events. These events include failed login attempts, login attempts outside the designated schedules, locked accounts, port sweeps, network activity levels, memory utilization, and key file or data access. • Problem detection: Investigators and network administrators use log data to identify security events and problems that need to be addressed.

Syslog Syslog is a combined audit mechanism used by the Linux operating system. It permits both local and remote log collection. Syslog allows system administrators to collect and distribute audit data with a single point of

Log Files as Evidence

Figure 1-1

1-9

IISLogger provides additional IIS logging functionality.

management. Syslog is controlled on a per-machine basis with the file /etc/syslog.conf. This configuration file consists of multiple lines like the following: mail.info

/var/log/maillog

The format of configuration lines is: facility.level

action

The Tab key is used to define white space between the selector on the left side of the line and the action on the right side. The facility is the operating system component or application that generates a log message, and the level is the severity of the message that has been generated. The action gives the definition of what is done with the message that matches the facility and level. The system administrator can customize messages based on which part of the system is generating data and the severity of the data using the facility and level combination. The primary advantage of syslog is that all reported messages are collected in a message file. To log all messages to a file, the administrator must replace the selector and action fields with the wildcard (*). Logging priorities can be enabled by configuring /var/log/syslog. All authorized messages can be logged with priorities such as emerg (highest), alert, crit, err, warning, notice, info, or debug (lowest). Events such as bad login attempts and the user’s last login date are also recorded. If an attacker logs into a Linux server as root using the secure shell service and a guessed password, the attacker’s login information is saved in the syslog file. It is possible for an attacker to delete or modify the /var/log/syslog message file, wiping out the evidence. To avoid this problem, an administrator should set up remote logging.

Remote Logging Centralized log collection makes simpler both day-to-day maintenance and incident response, as it causes the logs from multiple machines to be collected in one place. There are numerous advantages of a centralized log collection site, such as more effective auditing, secure log storage, easier log backups, and an increased chance for analysis across multiple platforms. Secure and uniform log storage might be helpful in case an attacker is prosecuted based on log evidence. In such cases, thorough documentation of log handling procedures might be required.

1-10

Chapter 1

Log replication may also be used to audit logs. Log replication copies the audit data to multiple remotelogging hosts in order to force an attacker to break into all, or most, of the remote-logging hosts in order to wipe out evidence of the original intrusion.

Preparing the Server for Remote Logging The central logging server should be set aside to perform only logging tasks. The server should be kept in a secure location behind the firewall. The administrator should make sure that no unnecessary services are running on the server. Also, the administrator should delete any unnecessary user accounts. The logging server should be as stripped down as possible so that the administrator can feel confident that the server is secure.

Configuring Remote Logging The administrator must run syslogd with the -r option on the server that is to act as the central logging server. This allows the server to receive messages from remote hosts via UDP. There are three files that must be changed: • In the file /etc/rc.d/init.d/syslog, a line reads: SYSLOGD_OPTIONS=“-m 0” The administrator must add the -r flag to the options being passed to syslog: SYSLOGD_OPTIONS=“-m 0 -r” The -r option opens the syslog daemon port 514 and makes syslog listen for incoming log information. • In the file /etc/sysconfig/syslog, there is a line similar to the above line. The administrator needs to add the -r flag to this line also. • The administrator needs to integrate the syslog daemon service into the /etc/services files. Syslog 514/udp The administrator must run the following command after altering the three files: /sbin/service syslog restart A reference should appear in the var/log/messages file indicating that the remote syslog server is running. The syslog server can be added to the /etc/syslogd.conf file in the client, which can preserve an audit trail even if a cracker does an rm -rf. Other servers can be configured to log their messages to the remote server by modifying the action field in the syslog.conf as: Auth.* @myhost

Tool: Syslog-ng Syslog-ng is a flexible and scalable audit-processing tool. It offers a centralized and securely stored log for all the devices on a network. The following are some of the features of Syslog-ng: • It guarantees the availability of logs. • It is compatible with a wide variety of platforms. • It is used in heavily firewalled environments. • It offers proven robustness. • It allows a user to manage audit trails flexibly. • It has customizable data mining and analysis capabilities. • It allows a user to filter based on message content. Figure 1-2 shows a screenshot from Syslog-ng.

Tool: Socklog Socklog is a small and secure replacement for syslogd. It runs on Linux (glibc 2.1.0 or higher, or dietlibc), OpenBSD, FreeBSD, Solaris, and NetBSD. The following are some of the features of Socklog: • It selects and deselects log entries. • It has a small code size.

Log Files as Evidence

Figure 1-2 network.

1-11

An administrator can use Syslog-ng to manage logs for all devices on a

• It provides modular and reliable network logging. • It merges different logs and sorts them in order. • Log file rotation is based on file size. • It receives syslog messages from a UNIX domain socket (/dev/log) and writes them to various files on the disk, depending on facility and priority. • It receives syslog messages from a UDP socket (0.0.0.0:514) and writes them to various files on the disk, depending on facility and priority. • It writes received syslog messages to a UDP socket (a.b.c.d:514). The following describes the elements of Socklog: • The socklog-unix service listens on the UNIX domain socket /dev/log. Usually, this service replaces syslogd. • The socklog-inet service listens on the UDP port 0.0.0.0:514. Usually, this service replaces syslogd’s support for remote logging. • The socklog-klog service reads kernel messages from /proc/kmsg on Linux or /dev/klog on BSD. Usually, this service replaces klogd on Linux or syslogd on BSD. • The socklog-ucspi-tcp service listens on the TCP port 0.0.0.0:10116; this is a service for Socklog network logging, a different remote logging concept. • The socklog-notify service handles log event notification and scheduled notification of specified log entries.

1-12

Chapter 1

Tool: Kiwi Syslog Daemon Kiwi Syslog Daemon is a freeware syslog daemon for Windows. It receives logs and displays and forwards syslog messages from routers, switches, UNIX hosts, and any other syslog-enabled device. There are many customizable options available. Some of the basic features include: • PIX firewall logging • Linksys home firewall logging • SNMP trap and TCP support • SNMP MIB parsing • Ability to filter, parse, and modify messages and take actions via VBScript/JScript engine • GUI-based syslog manager • Real-time message display as messages are received • Ten virtual displays for organizing messages • Message logging or forwarding of all messages, or based on priority or time of day • Message receipt via UDP, TCP, or SNMP • Message forwarding via UDP or TCP • Automatic log file archiving based on a custom schedule • Messages per hour alarm notification with audible sound or e-mail • Log file size alarm notification with audible sound or e-mail • Daily e-mailing of syslog traffic statistics • Maintenance of source address when forwarding messages to other syslog hosts • DNS resolution of source host IP addresses with optional domain removal • DNS caching of up to 100 entries to ensure fast lookups and to minimize DNS lookups • Preemptive DNS lookups using up to 10 threads Some of the additional features in the licensed version include: • Greater flexibility in managing and inspecting log files produced by Kiwi Syslog Daemon, particularly in larger networks • Additional filtering options for greater and simpler control of subsequent actions • A large number of additional actions that can be automatically initiated as a result of incoming messages, filters, and rules • A much larger buffering capacity; this increased capacity greatly increases the scale of the network that can be supported, as well as providing greater reliability in handling peak busy periods or message spikes. • Additional alarm options • Priority e-mail support • Preemptive DNS lookups using up to 200 threads • Ability to pass values—such as message text, time of message, date of message, host name, facility, level, alarm threshold values, and current syslog statistics—from the received syslog messages to an external program, e-mail message, or syslog message Figure 1-3 shows the setup screen for Kiwi Syslog Daemon.

Tool: Microsoft Log Parser Microsoft Log Parser is a powerful, versatile, robust command-line tool that offers a SQL interface to various log file formats and is fast enough for log file analysis of many Web sites.

Log Files as Evidence

Figure 1-3

1-13

Kiwi Syslog Daemon offers administrators a wealth of customizable options.

The following are some of the features of Microsoft Log Parser: • It enables a user to run SQL-like queries against log files of any format. • It produces the desired information either on the screen, in a file, or in an SQL database. • It allows multiple files to be piped in or out as source or target tables. • It generates HTML reports and MS Office objects. • It supports conversion between SQL and CSV formats. Figure 1-4 shows a screenshot from Log Parser.

Microsoft Log Parser Architecture Log Parser provides a global query access to text-based data such as IIS log files, XML files, text files, and CSV files, and key data sources like the Windows Event Log, the registry, the file system, user plug-ins, and Active Directory. All the queries of the log files and key data sources use a common SQL-like syntax. The following are the supported operating systems for Microsoft Log Parser: • Windows 2000 • Windows Server 2003 • Windows XP Professional

Tool: Firewall Analyzer Firewall Analyzer is a Web-based firewall monitoring and log analysis tool that collects, analyzes, and reports information on enterprise-wide firewalls, proxy servers, and RADIUS servers.

1-14

Chapter 1

Figure 1-4 queries.

Microsoft Log Parser allows a user to analyze log files using SQL-like

The following are some of the features of Firewall Analyzer: • Bandwidth usage tracking • Intrusion detection • Traffic auditing • Anomaly detection through network behavioral analysis • Web site user access monitoring • Automatic firewall detection and configuration • Anomaly filtering • Historical trend reporting • Predefined reports • Customizable reports • Report scheduling • Rule-based alerting • Flexible archiving • Portability • Multiplatform support Figure 1-5 shows a screenshot from Firewall Analyzer.

Tool: Adaptive Security Analyzer (ASA) Pro Adaptive Security Analyzer (ASA) Pro is a security and threat intelligence application that continuously monitors dynamic, high-volume, heterogeneous security-related data; recognizes and quantifies the extent of event abnormality; and advises security personnel of the factors that contributed most to the event’s classification. It enables a user to do the following: • Model security specialist expertise • Baseline what is normal for a computing environment • Identify published threats • Identify activity matching predefined criteria

Log Files as Evidence

1-15

Figure 1-5 This is the main screen of Firewall Analyzer.

• Identify, measure, and prioritize all anomalous events • Generate root cause insight of threats • Feed new knowledge back into the system The following are some of the features of ASA Pro: • It accelerates threat response. • It has improved preemptive capabilities. • It expands resource capacity. • It maximizes return on security and other IT assets. • It eliminates information overload. • It reinforces regulatory compliance. • It has improved productivity. Figure 1-6 shows a screenshot from ASA Pro.

Tool: GFI EventsManager GFI EventsManager collects data from all devices that use Windows event logs, W3C, and syslog, and applies rules and filtering to identify key data. GFI EventsManager also provides administrators with real-time alerting when critical events arise, and it suggests remedial action. The following are some of the features of GFI EventsManager: • Network-wide analysis of event logs: GFI EventsManager contains an intelligent event processor that processes logs and available data in a centralized way. It controls and manages Windows event logs, W3C logs, and syslog events. • Explanations of cryptic Windows events: Cryptic logs make the log analysis process difficult. GFI EventsManager translates these cryptic events into clear and concise explanations. • Centralized event logging: Event logs can be generated by users or automatically by background processes. These logs are stored in different locations. GFI EventsManager stores all these logs in one SQL database.

1-16

Chapter 1

Figure 1-6 ASA provides extensive details about security events.

• High-performance scanning engine: GFI EventsManager contains a high-performance event-scanning engine. It is able to scan and collect up to six million events an hour. • Real-time alerts: GFI EventsManager alerts administrators when it detects any key events or intrusions. It can send this alert to multiple people by e-mail or SMS. • Advanced event filtering features: GFI EventsManager’s filtering process sieves through recorded event logs. It allows administrators to select the events they want, without deleting any event from the database. • Report viewing for key security information happening on the network: GFI EventsManager allows administrators to detect security trends. These standard reports consist of: • Policy-change reports • Windows event log system reports • Event trend reports • Account usage reports • Application management reports • Account management reports • Object access reports • Print server reports

How Does GFI EventsManager Work? GFI EventsManager divides the events management process in two stages: • Event collection: GFI EventsManager collects logs from different event sources. This happens with the help of the Event Retrieval Engine and the Event Receiving Engine. The Event Retrieval Engine collects Windows event logs and W3C logs from network log resources. The Event Receiving Engine works as the syslog server, collecting syslog messages sent by syslog sources.

Log Files as Evidence

1-17

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 1-7

GFI EventsManager manages events in two stages.

• Event processing: In this stage, GFI EventsManager runs a set of event processing rules over the collected events. These rules are the instructions that: • Analyze the collected event logs and categorize them into critical, low, high, and medium • Filter events related to particular conditions • Generate results, triggering e-mail and network alerts concerning key events; according to the results, it starts corrective actions, such as the execution of executable files or scripts in reaction to key events. Figure 1-7 shows how GFI EventsManager works.

Tool: Activeworx Security Center Activeworx Security Center is a security information and event management product. Activeworx Security Center monitors security-related events for a variety of devices from one central console. It allows for the discovery of threats, the correlation of relevant security information, and the analysis of vulnerabilities and attacks, and provides intelligence for security personnel to act upon. Figure 1-8 shows a screenshot from Activeworx Security Center.

1-18

Chapter 1

Figure 1-8 Activeworx Security Center lets an administrator choose which products to monitor for events.

Linux Process Accounting Process accounting is an audit mechanism for the Linux operating system. It tracks process execution and logon/ logoff events. It tracks every command that users execute. The process tracking log file can be found in /var/adm, /var/log, or /usr/adm. Administrators enable the process accounting mechanism using the accton command. Process accounting logs all the messages in its own binary format to /var/log/psacct. An administrator can view the tracked files using the lastcomm command. The lastcomm command gives information about previously executed commands. The following lines show example output from lastcomm: [root@server log]# lastcomm clear root man S root sh root sh F root less root crond F root mrtg S root crond F root sadc S root

stdout stdout stdout stdout stdout ?? ?? ?? ??

0.01 secs 0.00 secs 0.01 secs 0.00 secs 0.00 secs 0.00 secs 1.02 secs 0.00 secs 0.02 secs

Thu Nov 14 07:20 Thu Nov 14 07:19 Thu Nov 14 07:19 Thu Nov 14 07:19 Thu Nov 14 07:19 Thu Nov 14 07:20 Thu Nov 14 07:20 Thu Nov 14 07:20 Thu Nov 14 07:20

In this output, the first row stands for the processes executed; a flag follows each process name. The S flag stands for the superuser (root), and the F flag stands for a forked process. Each process should have the following information: • How the process was executed • Who executed the process

Log Files as Evidence

1-19

• When the process ended • Which terminal type was used The following are the limitations of process accounting: • It audits the information after the execution of the process. • It audits only the execution of commands.

Configuring Windows Logging Windows logging can be configured using Group Policy at the site, domain, organizational unit (OU), or local computer level. Audit policy can be found in Computer Configuration\Windows Settings\Security Settings\ Local Policies\Audit Policy. Before enabling logging, an administrator needs to keep in mind what needs to be logged; otherwise, overcollection of data can result, making it difficult to trace a critical event. The following are the events that need to be logged: • Logging on and logging off • User and group management • Security policy changes • Restarts and shutdowns An administrator can view each event generated by logging in the Event Viewer, which is automatically started when Windows starts. By default, security logging is not enabled on Windows 2000. Standard users can view only application and system logs. Access to security logs is available only to the system administrator. To ensure that security logs are available, the administrator should turn on security logging. There are several different logs an administrator needs to examine: • The application log contains events such as errors, warnings, or information logged by applications. Event classification is done by event type (severity), with “information” at the low end, “warning” in the middle, and “error” at the highest severity. • The security log maintains information about the success or failure of audited events. • The system log contains events generated by system components. It deals with driver failures and hardware issues. • Domain controllers contain a supplementary log concerning the directory service. • The File Replication service log has Windows File Replication service events. • DNS machines contain DNS events in the logs.

Setting Up Remote Logging in Windows An attacker usually removes any traces left behind after the attack. This is accomplished by deleting the c:\ winnt\system32\config\*.evt file, which erases the event tracking logs. To protect against this, administrators use remote logging. However, unlike Linux, Windows does not support remote logging. An administrator can use a third-party utility like NTsyslog to enable remote logging in Windows. NTsyslog runs as a service under Windows NT 4.0 and Windows 2000. It sends all system, security, and application events to a syslog host.

Tool: NTsyslog By default, the NTsyslog service runs under the LocalSystem account. The service can also be run as a local if that user is given the right to log on as a service and manage auditing and security logs. NTSyslogCtrl is a GUI tool that an administrator can use to configure which messages to monitor and the priority to use for each type. By default, sending all messages utilizes the user alert priority. This GUI tool is used for configuring the registry. To configure the syslog host manually, an administrator can create the following registry entry: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet] “Syslog” = “host.domain.com” An administrator can specify the syslog host by domain name or by IP address.

1-20

Chapter 1

Figure 1-9 An administrator can choose which events to forward to a syslog host using NTsyslog.

For redundancy, an administrator can specify an additional host by creating the following registry key: [HKEY_LOCAL_MACHINE\SOFTWARE\SaberNet]“Syslog1” = “backup.domain.com” Figure 1-9 shows a screenshot from NTsyslog.

Tool: EventReporter EventReporter is a tool that processes Windows event logs, parses them, and forwards the results to a central syslog server. EventReporter automatically monitors Windows event logs. It detects system hardware and software failures that damage the network. EventReporter integrates Windows systems with UNIX-based management systems. The following are the important features of EventReporter: • Monitoring • Filtering • Data collection • Alerting Multiple Windows event logs are allowed and are monitored by EventReporter. Event log information can be delivered through e-mail. Syslog facilities are supported. It produces an alert sound when information is received over the Internet.

Tool: EventLog Analyzer EventLog Analyzer is a Web-based syslog and event log management solution that collects, analyzes, archives, and reports on event logs from distributed Windows hosts and syslogs from UNIX hosts, routers, switches, and other syslog devices. The following are some of the features of EventLog Analyzer: • Event archiving • Automatic alerting • Predefined event reports • Historical trending

Why Synchronize Computer Times?

Figure 1-10

1-21

This shows the main screen of EventLog Analyzer.

• Centralized event log management • Security analysis • Automated event archiving • Importing event logs • Real-time alerting • Scheduled reporting • Multiple report export formats • Compliance reporting • Host grouping • Built-in database Figure 1-10 shows a screenshot from EventLog Analyzer.

Why Synchronize Computer Times? When an administrator is investigating intrusion and security events that involve multiple computers, it is essential that the computers’ clocks be synchronized. If computers’ clocks are not synchronized, it becomes almost impossible to accurately correlate actions that are logged on different computers. If the clocks on these computers are not accurate, it also becomes difficult to correlate logged activities with outside actions.

What Is NTP? NTP stands for Network Time Protocol. It is an Internet standard protocol (built on top of TCP/IP) that is used to synchronize the clocks of client computers. NTP sends time requests to known servers and obtains server time stamps. Using those stamps, it adjusts the client’s time.

1-22

Chapter 1

The following are some of the features of NTP: • It is fault tolerant and dynamically autoconfiguring. • It synchronizes accuracy up to one millisecond. • It can be used to synchronize all computers in a network. • It uses UTC time. • It is available for every type of computer.

NTP Stratum Levels Stratum levels determine the distance from the reference clock. A reference clock is stratum-0 equipment that is considered to be accurate and has little delay. The reference clock matches its time with the correct UTC time using long-wave radio signals, GPS transmissions, CDMA technology, or other time signals, such as WWV and DCF77. Stratum-0 servers are not directly used on the network. They are directly connected to computers that work as stratum-1 servers. Higher stratum levels are connected to stratum-1 servers over a network path; therefore, stratum-2 servers get their time from stratum-1 servers through NTP over a network link. In the same way, stratum-3 servers get their time from stratum-2 servers, and so on. Depending on the reference clock of a stratum-1 time server, its accuracy to UTC can be within less than one millisecond (ms). Figure 1-11 shows the different NTP stratum levels and how they are related.

NTP Stratum Levels Stratum 0

Stratum 1 Direct Connection (e.g. RS-232)

Network Connection NTP

Stratum 2

Stratum 3

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 1-11 Stratum-0 NTP servers are directly connected to stratum-1 servers, which are then connected to stratum-2 servers over the network.

Why Synchronize Computer Times?

1-23

NTP Time Servers The following tables list NTP time servers. The tables are provided as reference only. This list is not intended to be comprehensive. Any NTP time server selection should be evaluated to determine if the server in question meets specific time server requirements.

Server Name

IP Address

Location

time-a.nist.gov

129.6.15.28

NIST, Gaithersburg, Maryland

time-b.nist.gov

129.6.15.29

NIST, Gaithersburg, Maryland

time-a.timefreq.bldrdoc.gov

132.163.4.101

NIST, Boulder, Colorado

time-b.timefreq.bldrdoc.gov

132.163.4.102

NIST, Boulder, Colorado

time-c.timefreq.bldrdoc.gov

132.163.4.103

NIST, Boulder, Colorado

utcnist.colorado.edu

128.138.140.44

University of Colorado, Boulder

time.nist.gov

192.43.244.18

NCAR, Boulder, Colorado

time-nw.nist.gov

131.107.1.10

Microsoft, Redmond, Washington

nist1.dc.certifiedtime.com

216.200.93.8

Abovnet, Northern Virginia

nist1.datum.com

209.0.72.7

Datum, San Jose, California

nist1.nyc.certifiedtime.com

208.184.49.129

Abovnet, New York City

nist1.sjc.certifiedtime.com

207.126.103.202

Abovnet, San Jose, California

Table 1-1 This is a list of time servers maintained by NIST

Server Name

IP Address

Location

Service Area

usno.pa-x.dec.com; CNAME: navobs1.pa-x.dec.com

204.123.2.72

Palo Alto, CA: Systems Research Center, Compaq Computer Corp.

U.S. Pacific and Mountain time zones

timekeeper.isi.edu

128.9.176.30

Marina del Rey, CA: USC Information Sciences Institute

CalRen2 and Los Nettos region

tock.usno.navy.mil, tick.usno. navy.mil

192.5.41.41, 192.5.41.40

Washington, DC: U.S. Naval Observatory

NSFNET

Ottawa, Ontario, Canada: National Research Council of Canada

Canada

time.chu.nrc.ca

terrapin.csc.ncsu.edu

152.1.58.124

Raleigh, NC: North Carolina State University

Southeastern U.S.

bitsy.mit.edu

18.72.0.3

Cambridge, MA: MIT Information Systems

NSFNET and NEARnet area

bonehed.lcs.mit.edu

18.26.4.105

Cambridge, MA: MIT

Eastern U.S.

clock.isc.org

192.5.5.250

Palo Alto, CA: Internet Software Consortium

BARRnet, Alternet-west, and CIX-west

clock.osf.org

130.105.4.59

Cambridge, MA: Open Software Foundation

NSFNET and NEARnet region

clock.via.net

209.81.9.7

Palo Alto, CA: ViaNet Communications

lerc-dns.lerc.nasa.gov

128.156.1.43

Cleveland, OH: Lewis Research Center (NASA)

NSFNET and OARNET

navobs1.usnogps.navy.mil, CNAME: tick.usnogps.navy. mil; navobs2.usnogps.navy.mil, CNAME: tock.usnogps.navy.mil

204.34.198.40, 204.34.198.41

Colorado Springs, CO: Schriever AFB

U.S. Pacific and Mountain time zones

navobs1.wustl.edu, CNAME: tick.wustl.edu

128.252.19.1

St. Louis, MO: Washington University

U.S. Central time zone

Table 1-2 This is a list of stratum-1 time servers

(continues)

1-24

Chapter 1

Server Name

IP Address

Location

Service Area

ncnoc.ncren.net

192.101.21.1

Research Triangle Park, NC: MCNC

NC-REN region

ntp-cup.external.hp.com

192.6.38.127

Cupertino, CA: HP

West Coast U.S.

ntp1.delmarva.com

138.39.7.20

Newark, DE: Conectiv Communications

Cable & Wireless Network (formerly MCInet)

otc1.psu.edu

128.118.46.3

University Park, PA: Penn State University

NSFNET, PREPNET, and JvNCnet

vega.cbk.poznan.pl

150.254.183.15

Borowiec, Poland: Astrogeodynamical Observatory, Space Research Centre

Poland and Europe

Time2.Stupi.SE

192.36.143.151

Stockholm, Sweden: Stupi AB

Europe

time.ien.it

193.204.114.1

Torino, Italy: IEN Galileo Ferraris

Italy and Europe

swisstime.ethz.ch

129.132.2.21

Zurich, Switzerland: Integrated Systems Lab, Swiss Fed. Inst. of Technology

Switzerland and Europe

tempo.cstv.to.cnr.it

150.145.33.1

Torino, Italy: CSTV of National Research Council

Italy and Europe

Erlangen, Germany: University Erlangen-Nuernberg

Germany and Europe

ntp0.fau.de, ntp1.fau.de, ntp2 .fau.de, ntps1-0.uni-erlangen .de, ntps1-1.uni-erlangen.de, ntps1-2.uni-erlangen.de ntps1-0.cs.tu-berlin.de, ntps1-1.cs.tu-berlin.de

130.149.17.21, 130.149.17.8

Berlin, Germany: Technische Universitaet Berlin

Germany and Europe

ntps1-1.rz.Uni-Osnabrueck.DE

131.173.17.7

Germany

Germany and Europe

Time1.Stupi.SE

192.36.143.150

Sweden

SUnet and NORDUnet Sweden

clock.cuhk.edu.hk

137.189.6.18

Hong Kong: The Chinese University of Hong Kong

Hong Kong, China, and Southeast Asia

clock.nc.fukuoka-u.ac.jp, clock.tl.fukuoka-u.ac.jp

133.100.9.2, 133.100.11.8

Fukuoka, Japan: Fukuoka University

Japan and Pacific area

ntp.cs.mu.OZ.AU

128.250.36.2

Melbourne Australia: The University of Melbourne

Australia and New Zealand

Location

Service Area

ntp1.cmc.ec.gc.ca, ntp2.cmc.ec.gc.

Quebec, Canada: Canadian Meteorological Center

Eastern Canada

time.chu.nrc.ca; time.nrc.ca

Ontario, Canada: National Research Council of Canada

Canada

Saskatchewan, Canada: University of Regina

Canada

tick.utoronto.ca, tock.utoronto.ca

Ontario, Canada: University of Toronto

Eastern Canada

ntp2a.audiotel.com.mx, ntp2c.audiotel.com.mx, ntp2b.audiotel.com.mx

Mexico: Audiotel office

Avantel, MCINet, and Mexico

Table 1-2 This is a list of stratum-1 time servers continued

Server Name

timelord.uregina.ca

IP Address

142.3.100.15

ns.scruz.net

165.227.1.1

Santa Cruz, CA: Scruz-net, Inc.

Western U.S.

ntp.ucsd.edu

132.239.254.49

San Diego, CA: UCSD Academic Computing Services/Network Operations

CERFNET, NSFNET, SDSC region, and nearby

Table 1-3 This is a list of stratum-2 time servers

Why Synchronize Computer Times?

Server Name

IP Address

1-25

Location

Service Area

Quincy, CA

North America

Newark, DE: University of Delaware

CAIRN, Abilene, and vBNS

ntp.shorty.com

Atlanta, GA: CNSG

Southeastern U.S.

rolex.peachnet.edu, timex.peachnet.edu

Kennesaw, GA: PeachNet

PeachNet (Georgia) and southeastern U.S.

ntp-0.cso.uiuc.edu, ntp-1.cso .uiuc.edu, ntp-2.cso.uiuc.edu

Urbana-Champaign, IL: University of Illinois

CICNET, Midwest, and NCSA region

ntp-1.mcs.anl.gov, ntp-2.mcs.anl.gov

Chicago, IL: Argonne National Laboratory

NSF/ANSNet, CICNet, NetIllinois, and ESNet

gilbreth.ecn.purdue.edu, harbor.ecn.purdue.edu, molecule.ecn.purdue.edu

West Lafayette, IN: Purdue University

NSFNET and CICNET area

ntp1.mainecoon.com, ntp2.mainecoon.com louie.udel.edu

128.175.1.3

ntp1.kansas.net, ntp2.kansas.net

199.240.130.1, 199.240.130.12

Manhattan, KS: KansasNet OnLine Services

Central U.S. and Great Plains

timeserver.cs.umb.edu

158.121.104.4

Boston, MA: UMass-Boston CS dept.

New England

Minneapolis/St. Paul, MN: University of Minnesota

CICNET region

ns.nts.umn.edu, nss.nts.umn.edu everest.cclabs.missouri.edu

128.206.206.12

Columbia, MO: University of Missouri-Columbia

MOREnet

allison.radiks.net

205.138.126.83

Omaha, NE: Radiks Internet Access

Midwest U.S.

cuckoo.nevada.edu

131.216.1.101

Las Vegas, NV: University of Nevada System Computing Services

NevadaNet, NSFNET, and SDSC region

tick.cs.unlv.edu, tock.cs.unlv.edu

Las Vegas, NV: UNLV College of Engineering

Sprintnet

ntp.ctr.columbia.edu

New York, NY: Columbia University

Sprintlink and NYSERnet

Ithaca, NY: Cornell University

NSFNET and NYSER region

sundial.columbia.edu

New York, NY: Morningside Campus, Columbia University

NYSERnet

timex.cs.columbia.edu

New York, NY: Columbia University Computer Science Department

PSINET, NSFNET, and NYSER region Midnet

ntp0.cornell.edu

192.35.82.50

constellation.ecn.uoknor.edu

129.15.22.8

Norman, OK: University of Oklahoma

tick.koalas.com

207.48.109.6

Coos Bay, OR: Koala Computers

Northwestern U.S.

clock.psu.edu

128.118.25.3

University Park, PA: Penn State University

Internet2, vBNS, CERFnet (AT&T IP Services), PSC/NCNE, and CASC

fuzz.psc.edu

128.182.58.100

Pittsburgh, PA: Pittsburgh Supercomputing Center

NSFNET and PSC region

Pittsburgh, PA: Carnegie Mellon Electrical and Computer Engineering

PREPNET and PSC region

ntp-1.ece.cmu.edu, ntp-2.ece.cmu.edu ntp.cox.smu.edu

129.119.80.126

Dallas, TX: Cox School of Business, Southern Methodist University

NSFNET and SESQUI region

ntp.fnbhs.com

209.144.20.76

Hughes Springs, TX: First National Bank

Northeastern Texas

Table 1-3 This is a list of stratum-2 time servers

(continues)

1-26

Chapter 1

Server Name

IP Address

Location

Service Area

ntp.tmc.edu

128.249.1.10

Houston, TX: Baylor College of Medicine

NSFNET and SESQUI region

ntp5.tamu.edu

165.91.52.110

College Station, TX: Texas A&M University

NSFNET, SESQUI region, THEnet, and TAMUSDSN

tick.greyware.com, tock.greyware.com

Plano, TX: Greyware Automation Products

South-central U.S.

ntp-1.vt.edu, ntp-2.vt.edu

Blacksburg, VA: Virginia Tech Computing Center

Southeastern U.S.

ntp.cmr.gov

140.162.1.3

Arlington, VA: Center for Seismic Studies

NSFNET and SURA region

clock.tricity.wsu.edu

192.31.216.30

Richland, WA: Washington State University

NSFNET and NorthWestNet

time.ultimeth.net

Washington, U.S.: Mill Creek

Northwestern U.S.

ntp1.cs.wisc.edu, ntp2.cs.wisc.edu, ntp3.cs.wisc.edu

Madison, WI: Computer Science Department, University of Wisconsin-Madison

U.S. and any

Buenos Aires, Argentina: Network Access Point

Argentina

Buenos Aires, Argentina: Sinectis S.A.

Argentina

tick.nap.com.ar, tock.nap.com.ar

200.49.40.1, 200.49.32.1

time.sinectis.com.ar ntp.cais.rnp.br

200.144.121.33

Brazil: Brazilian Research Network

Brazil

ntp.linux.org.ve

150.185.192.250

Venezuela: VELUG, Grupo de Usuarios Linux de Venezuela

Arica

bernina.ethz.ch

129.132.98.11

Zurich, Switzerland: Swiss Fed. Inst. of Technology

Switzerland and Europe

Copenhagen, Denmark, Europe

Denmark, Scandinavia, and Northern Europe

slug.ctv.es

Spain: Altea

Spain

tick.keso.fi, tock.keso.fi

Pieksamaki, Finland: KeskiSavon Oppimiskeskus

Finland

ntp.obspm.fr

Meudon, France: Observatoire de Paris-Meudon

France and Europe

ntp.univ-lyon1.fr

Lyon, France: CISM

France, Switzerland, Italy, and Europe

clock.netcetera.dk, clock2.netcetera.dk

ntp.via.ecp.fr

138.195.130.70

Paris, France: VIA, Ecole Centrale

France and Europe

time.kfki.hu

148.6.0.1

Budapest, Hungary: KFKI Research Institute for Particle and Nuclear Physics

HUNGARNET

ntps.net4u.it

195.32.52.129

Vercelli, Italy: Net4u Srl

Italy

fartein.ifi.uio.no

129.240.64.3

Oslo, Norway: University of Oslo

NORDUnet

Oslo, Norway: Alcanet International

Europe

time.alcanet.no info.cyf-kr.edu.pl

149.156.4.11

Krakow, Poland: Academic Computer Centre

Poland and Europe

ntp.lth.se

130.235.20.3

Lund, Sweden: Lund Institute of Technology

Sweden and NORDUnet

biofiz.mf.uni-lj.si

193.2.69.11

Ljubljana, Slovenia: Institute of Biophysics, University of Ljubljana

Slovenia and Europe

Table 1-3 This is a list of stratum-2 time servers continued

Why Synchronize Computer Times?

Server Name

IP Address

1-27

Location

Service Area

hmljhp.rzs-hm.si

Ljubljana, Slovenia: Hydrometeorological Institute of Slovenia

Slovenia and Europe

ntp1.arnes.si, ntp2.arnes.si

Ljubljana, Slovenia: Academic and Research Network of Slovenia

Slovenia and Europe

time.ijs.si

Ljubljana, Slovenia: J. Stefan Institute

Slovenia and Europe

ntp.cs.tcd.ie, ntp.maths.tcd.ie, ntp.tcd.ie

Dublin, Ireland: School of Mathematics, Trinity College

Ireland and U.K.

ntp.cs.strath.ac.uk

Glasgow, Scotland: Strathclyde University

U.K., Europe, and any

ntp0.uk.uu.net, ntp1.uk.uu.net, ntp2.uk.uu.net

Cambridge, U.K.

UUNET (formerly known in the U.K. as PIPEX) and U.K.

ntp2a.mcc.ac.uk, ntp2b.mcc.ac.uk, ntp2c.mcc.ac.uk, ntp2d.mcc.ac.uk

Manchester, England: University of Manchester

U.K.

tick.tanac.net

Buckinghamshire U.K.: Wibble U.K., Aylesbury

U.K.

ntp.landau.ac.ru

193.233.9.7

Moscow, Russia: Landau Institute for Theoretical Physics

Russia

ntp.psn.ru

194.149.67.130

Russia: Pushchino (near Moscow)

Russia

sign.chg.ru

193.233.46.10

Chernogolovka, Russia: Chernogolovka Scientific Center (near Moscow)

Russia

ntp.cyber-fleet.net

203.139.30.195

Tokyo, Japan: Cyber Fleet, Inc.

Japan and East Asia

time.nuri.net

Seoul, Korea: Inet, Inc.

Korea, Japan, Hong Kong, and East Asia

truechimer.waikato.ac.nz, truechimer1.waikato.ac.nz, truechimer2.waikato.ac.nz, truechimer3.waikato.ac.nz

Hamilton, New Zealand: The University of Waikato

New Zealand

ntp.shim.org

Singapore and the Philippines

Singapore

ntp.supernet300.com

Lagos, Nigeria: Supernet300

Western Africa (primarily Nigerian NITEL backbone)

ntp.cs.unp.ac.za

143.128.82.200

Pietermaritzburg, South Africa: Natal University

South Africa

augean.eleceng.adelaide.edu.au, ntp.adelaide.edu.au

129.127.28.4, 129.127.40.3, 203.21.37.18

Adelaide, South Australia: The University of Adelaide

AARNet

time.esec.com.au

203.21.84.4

Carlton, Victoria, Australia: eSec Limited

Table 1-3 This is a list of stratum-2 time servers

Configuring the Windows Time Service To configure Windows time service to use an internal hardware clock, follow these steps: 1. Click Start, click Run, type regedit, and then click OK. 2. Locate and then click on the registry subkey HKEY LOCAL MACHINE\SYSTEM\CurrentControlSet\ Services\W32Time\Parameters. 3. In the right pane, right-click ReliableTimeSource, and then click Modify.

1-28

Chapter 1

4. In Edit DWORD Value, type 1 in the Value data box, and then click OK. 5. Locate and then click on the registry subkey HKEY LOCAL MACHINE\SYSTEM\CurrentControlSet\ Services\W32Time\Parameters. 6. In the right pane, right-click LocalNTP, and then click Modify. 7. In Edit DWORD Value, type 1 in the Value data box, and then click OK. 8. Quit Registry Editor. 9. At the command prompt, run the net stop w32time && net start w32time command to restart the Windows time service. 10. “Run the w32tm -s command on all computers other than the time server to reset the local computer’s time against the time server.”

Chapter Summary ■

Syslog is a combined audit mechanism used by the Linux operating system.

■

Centralized binary logging is a process in which multiple Web sites send binary and unformatted log data to a single log file.

■

Linux process accounting tracks the commands that each user executes.

■

Monitoring intrusion and security events includes both passive and active tasks.

■

A key component of any computer security system is regular review and analysis of both certain standard system log files, as well as the log files created by firewalls and intrusion detection systems.

■

NTP is an Internet standard protocol (built on top of TCP/IP) that assures accurate synchronization to the millisecond of computer clock times in a network of computers.

■

NTP stratum levels define the distance from the reference clock.

Review Questions 1. List the steps to implement central logging. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 2. Explain end-to-end forensic investigation. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 3. What do you understand about remote logging? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 4. What is the importance of synchronized time? ___________________________________________________________________________________________ ___________________________________________________________________________________________

Hands-On Projects

1-29

5. Explain Linux process accounting. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 6. What is the importance of audit logs? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 7. Describe event gathering. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 8. How can you examine intrusion and security events? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 9. Explain how to configure the Windows Time service. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 10. List the different log analysis tools. ___________________________________________________________________________________________ ___________________________________________________________________________________________

Hands-On Projects 1. Run the tool Syslog-ng and see the results. 2. Run the tool Adaptive Security Analyzer (ASA) Pro and see the results. 3. Download the tool Swatch from http://swatch.sourceforge.net/. Run and monitor current server logs. 4. Set up remote logging in Windows with the help of NTsyslog. 5. Run the tool EventReporter and monitor the event logs in Windows.

This page intentionally left blank

Chapter

2

Investigating Network Traffic

Objectives After completing this chapter, you should be able to: • • • • • • • • •

Understand network protocols Understand the physical and data link layers of the OSI model Understand the network and transport layers of the OSI model Describe types of network attacks Understand the reasons for investigating network traffic Perform evidence gathering via sniffing Describe the tools used in investigating network traffic Document the evidence gathered on a network Reconstruct evidence for an investigation

Key Terms the method of wrapping data from one layer of the OSI model in a new data structure so that each layer of the OSI model will only see and deal with the information it needs in order to properly handle and deliver the data from one host to another on a computer network Internet Protocol (IP) a communications protocol used for transferring data across packetswitched networks. Part of what is known as the Internet Protocol suite (TCP/IP), it is used to define addressing of datagram packets containing both a source and destination address to transfer the encapsulated data across multiple networks. It functions at the network layer of the OSI model and is usually found in IPv4 (a 32-bit number) or the newer IPv6 (a 128-bit number). Local area network (LAN) a set of host machines (computers, printers, etc.) in a relatively contiguous area, allowing for high data transfer rates among hosts on the same IP network; With LAN addressing, each node in the LAN has a unique MAC (media access control) address assigned to the NIC (network interface card) Media access control (MAC) address the unique 48-bit serial number assigned to each network interface card, providing a physical address to the host machine Encapsulation

2-1

2-2

Chapter 2 Network interface card (NIC) a piece of hardware used to provide an interface between the host machine and a computer network; functions at both the physical and data link layers of the OSI model Promiscuous mode the mode of a network interface card in which the card passes all network traffic it receives to the host computer, rather than only the traffic specifically addressed to it

Case Example Jessica, a university student, was known to be an introvert among her peers. She used to live with her father. One day, Jessica left a note for her father mentioning that she was going to meet her old school friend and would be back by the end of the week. A week passed, but Jessica did not return. Her father, Shane, filed a missing persons report with the police. All the students who interacted with Jessica were questioned to get some clue about her whereabouts, but none of them knew where she was. Two weeks later, Jessica’s dead body was found near a dumping ground near her university campus. An investigator was called in from a special force to investigate the case. Jessica’s interest in computers was revealed during an interview with her father. Digital forensic investigators from the special force were called in to investigate Jessica’s computer. Preliminary investigation of Jessica’s computer revealed some facts that shed some light on the case. Jessica’s system logs showed that Jessica frequented Web sites related to bondage and sex. Further investigations revealed Jessica’s e-mail address. The autologin feature was enabled on her e-mail client, so the investigators were able to get into her e-mail account. They scanned Jessica’s e-mails for clues. One e-mail address caught the attention of the investigators, as there was constant interaction with this one person. The investigators traced the e-mail service provider of the unknown person. The trace revealed that the e-mail address belonged to a man named Nichol. The investigators analyzed Nichol’s computer after the state judiciary granted them permission to do so. They found pornography and materials related to bondage and murder on Nichol’s computer. Nichol was questioned and after long hours of investigation, he broke down and admitted to the crime.

Introduction to Investigating Network Traffic This chapter focuses on investigating network traffic. It begins by explaining some basic networking concepts, such as network addressing schemes and the OSI model. It then moves into discussing the ways that an intruder can attack a network. The chapter also covers how an investigator can gather evidence from different parts of the network and what tools an investigator can use to gather this evidence.

Network Addressing Schemes There are two methods of network addressing: LAN addressing and Internetwork addressing.

LAN Addressing A local area network (LAN) is a set of host machines in a relatively contiguous area, allowing for high data transfer rates among hosts on the same IP network. With LAN addressing, each node in the LAN has a unique MAC (media access control) address assigned to the NIC (network interface card). A MAC address is a unique 48-bit serial number assigned to each network interface card, providing a physical address to the host machine. An NIC is a piece of hardware used to provide an interface between a host machine and a computer network. A MAC address may be one of the following types: • Static address: This is the 48-bit unique address programmed by the Ethernet board manufacturer into the hardware of the computer. This address is permanent and changes only if the NIC changes. • Configurable address: This type of address is programmed into the NIC during the initial installation of the hardware, and becomes static after that. A user can set this type of address through switches or jumpers on the circuit board, or through software. • Dynamic address: This type of MAC address is obtained when the computer is powered on and connected to the network. Due to this, there are chances that a number of systems have the same address. In LAN addressing, packets are either addressed to one node or, in the case of broadcasting, to all the nodes in the LAN. Broadcasting is often used to discover the services or devices on the network.

Internetwork Addressing Internetwork addressing is used in a network where a number of LANs or other networks are connected with the help of routers. Each network in this Internetwork has a unique network ID or network address. Routers use

Overview of Network Protocols

2-3

these addresses when data packets are transmitted from a source to its target. Each node in the network has its own unique address known as the host address or node ID. An Internetwork address is a combination of both a network address and host address. When a data packet is transmitted from one host to another in an Internetwork, the router does not know the host address, but it knows the network address of the network to which that host belongs. After the packet is transmitted to the correct network, the packet goes to the destination host.

OSI Reference Model Prior to the introduction of the OSI (Open Systems Interconnection) reference model, most networks were proprietary, with different standards and protocols for different vendor-developed networks. The OSI initiative sought to standardize networking to allow for interoperability across networks. The OSI model consists of seven layers, as shown in Figure 2-1. Each layer contains a set of similar functions and provides services to the layer above it. The OSI reference model is based on the following principles: • Every layer has a fully defined function. • The boundaries of the layers have been designed to reduce the flow of information in the interface. • When an additional level of abstraction is required, then a layer is created. • Each layer contains the functions of the international standardized protocol. The OSI model implements a concept known as encapsulation. Encapsulation is the method of wrapping data from one layer of the OSI model in a new data structure so that each layer of the OSI model will only see and deal with the information it needs in order to properly handle and deliver the data from one host to another on a computer network. The system that implements the protocol behavior and contains the different layers is called the protocol stack, as shown in Figure 2-1.

Overview of Network Protocols In the seven layers of the OSI model, protocols exist in only six layers; the physical layer contains no network protocols. The following sections describe the protocols used in these six OSI layers.

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 2-1

The OSI protocol stack consists of seven layers.

2-4

Chapter 2

Data Link Layer The following are the main protocols for the data link layer: • Point-to-Point Protocol (PPP): It is the standard for the transport of IP traffic over point-to-point links. It consists of three main components: 1. High-Level Data Link Control (HDLC) protocol is used by PPP to sum up the data between the source and destination links. 2. Link Control Protocol is used in establishing, configuring, and testing the data link connection between the source and the destination IP address. 3. Network Control Protocols (NCPs) are used to negotiate options for network layer protocols running on top of PPP. • Serial Line Internet Protocol (SLIP): IP packets were relayed over dial-up lines using SLIP. SLIP was replaced by PPP. • Address Resolution Protocol (ARP): ARP is considered a part of the data link layer, even though it is a part of TCP/IP.

Network Layer The following are the main protocols for the network layer: • RARP (Reverse Address Resolution Protocol): RARP is a TCP/IP protocol that can allow an IP address to be changed into a physical address. Systems that do not have a disk drive will have only their hardware interface address listed in the attributes when booted. Users can discover the IP address from an external source with the help of a RARP server. • ICMP (Internet Control Message Protocol): ICMP is an extension of IP and supports packets that have error and control messages. A common example of the ICMP protocol is the ping command in DOS. • IGMP (Internet Group Management Protocol): IGMP is used to manage the membership of multicast groups that are available on a single network. There are many features of this protocol by which a host computer is informed about its local router. • IP (Internet Protocol): IP is a communications protocol used for transferring data across packetswitched networks. Often paired with TCP (Transmission Control Protocol), its purpose is to send datagrams from the destination to the source.

Transport Layer The following are the main protocols for the transport layer: • UDP (User Datagram Protocol): UDP is a connectionless protocol that is different from TCP/IP in that it provides few error recovery services. It can broadcast datagrams over an IP network. • TCP (Transmission Control Protocol): TCP is a main component in TCP/IP networks. The reliable, connection-oriented protocol mainly involves dealing with packets sent from one system to another. The TCP protocol enables two hosts to create a connection and exchange different types of data.

Session Layer, Presentation Layer, and Application Layer The following are the main protocols for the session layer, presentation layer, and application layer: • HTTP (Hypertext Transfer Protocol): HTTP is the standard used by the World Wide Web to transfer massages. This protocol defines the way in which messages are transmitted. The protocol also defines the actions browsers are required to take for various other commands. • SMTP (Simple Mail Transfer Protocol): SMTP is the standard for sending e-mail between servers. Systems on the Internet make use of this protocol to send e-mail from one server to another. • NNTP (Network News Transfer Protocol): NNTP is the standard protocol for distributing and recovering Usenet messages. • Telnet: Telnet is a protocol that establishes a connection between a client and server, typically through TCP port 23.

Overview of Network and Transport Layers of the OSI Model

2-5

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 2-2

Different protocols are used in different layers in the TCP/IP model.

• FTP (File Transfer Protocol): FTP is the standard file transfer protocol in use on the Internet. This protocol works similarly to HTTP for transferring HTML files. FTP uses TCP/IP protocols to begin data transfer. • SNMP (Simple Network Management Protocol): SNMP is used to manage networks. This protocol functions by sending messages known as PDUs (protocol data units) to all parts of the network. • TFTP (Trivial File Transfer Protocol): TFTP is the most common form of FTP. This protocol makes use of UDP, which has no security attributes. Servers often use this protocol to assist in booting workstations that are not equipped with a disk drive. Figure 2-2 shows how all of these protocols fit into the TCP/IP model.

Overview of Physical and Data Link Layers of the OSI Model The Physical Layer The physical layer transmits raw bits over a communication channel. The design must ensure that when one side sends a 1 bit, the other side should receive that bit as a 1 bit, not a 0 bit. This layer deals with the mechanical, electrical, and procedural interfaces, and the physical transmission medium, which are all below the physical layer.

The Data Link Layer The data link layer breaks the raw transmission bits into data frames. Then, it sequentially broadcasts the frames, and the processed acknowledge frames are sent back by the receiver. The data link layer has the foremost function of creating and recognizing frame boundaries, since the physical layer only accepts and transmits a stream of bits without any regard to the meaning of the structure. The data link layer does this by adding special bit patterns to the beginning and the end of the frame. The data link layer also adds error detection functionality.

Overview of Network and Transport Layers of the OSI Model The Network Layer The network layer takes care of the delivery of data packets from the source to the destination. The need for a network layer does not arise if the two communicating network devices are connected to the same network. The network layer provides the logical address of the sender and receiver in the header of the data packet. The

2-6

Chapter 2

network layer responds to service requests from the transport layer. The network layer checks the integrity of the transferred data.

The Transport Layer The transport layer takes care of the entire message that is transferred from the source to the destination. In contrast, the network layer checks only for the delivery of the individual packets that make up the message. The network layer considers data packets of each message as individual entities. The transport layer takes care of error correction and flow control of the message. For security reasons, the transport layer establishes a connection between ports of the two communicating network devices. The entire packet in the message is associated with the connection. A connection is established in three steps: 1. Establishment of logical path 2. Transfer of data 3. Release of connection after data transfer Since all the packets are transmitted in a single path, the transport layer has more control over sequencing, flow control, and error correction of data packets.

Types of Network Attacks The following are the main categories of attacks launched against networks: • IP spoofing • Router attacks • Eavesdropping • Denial of service • Man-in-the-middle attack • Sniffing • Data modification

Why Investigate Network Traffic? The following are some of the reasons investigators analyze network traffic: • Locate suspicious network traffic • Know which network is generating the troublesome traffic and where the traffic is being transmitted to or received from • Identify network problems

Evidence Gathering at the Physical Layer A computer connected to a LAN has two addresses. The first is the MAC address, which is stored in the network card and uniquely identifies every node in a network. Ethernet uses the MAC address while building frames to transfer data from a system. The other address is the IP address. This address is used by applications. At the data link layer, the MAC address is used for addressing instead of the IP address. The MAC address is mapped to its respective IP address at the network layer. The data link layer looks for the MAC address of the destination machine in a table commonly known as the ARP cache. If an entry is not found for the IP address, then an ARP request will be broadcast to all machines on the network. The machine with the matched IP address then responds to the source machine with its MAC address. The MAC address of the destination machine gets added to the ARP cache of the source machine, and further communication is done using the MAC address. There are two basic types of Ethernet environments, and sniffers work slightly differently in both of these environments. The two types of Ethernet environments are shared Ethernet and switched Ethernet.

Shared Ethernet In this type of environment, every machine receives packets that are meant for one machine. One machine sends a packet with the MAC address of the source and destination to every machine. A machine with a MAC

DNS Poisoning Techniques

2-7

address that does not match the destination address simply discards the frame. A sniffer ignores this rule and accepts all frames by putting the NIC into promiscuous mode. Promiscuous mode is the mode of a network interface card in which the card passes all network traffic it receives to the host computer, rather than only the traffic specifically addressed to it. Hence, passive sniffing is possible in a shared Ethernet environment, but it is difficult to detect.

Switched Ethernet In this type of environment, hosts are connected to a switch, which has a table that keeps records of the MAC addresses of the host machines on the network. The switch transmits the data packets to the destination machines using this table. The switch does not broadcast to all computers but sends the packets to the appropriate destination only. Sniffing by putting the NIC into promiscuous mode does not work in this type of environment. A sniffer can capture packets in a switched environment only when the traffic is flooded to all ports. Flooding happens only when the switch does not have the MAC address of the destination in its content-addressable memory (CAM) table. For a sniffer to work in a switched environment, an extra feature is needed that captures traffic from the source port to the sniffer port. The port that is configured to receive all the packets sent by any source port is called the SPAN (Switched Port Analyzer) port. The drawback of a SPANned port is that it copies only legitimate Ethernet traffic. The error information related to the data packets is not copied, which limits the accuracy of evidence gathering. To overcome this limitation, hardware taps, also known as in-line taps, can be used for connecting more than one device to the switched port. This method helps the investigator get an accurate copy of the network traffic. Special switches are available that can be configured to allow sniffing at the switch that can even capture local traffic. Investigators can request an ISP to install a sniffer on its network for monitoring the traffic flowing between the ISP and a suspect’s computer. Special permissions need to be taken for this act. Sniffers cannot function when connected to a modem over a network. Sniffers collect traffic from the network and transport layers, not the physical and data link layers. Investigators have to configure sniffers for the size of the frames to be captured. The default frame size is usually 68 bytes. It is advisable to configure sniffers to collect frames with a size of 65,535 bytes.

DNS Poisoning Techniques DNS (Domain Name Service) is a service that translates domain names (e.g., www.eccouncil.org) into IP addresses (e.g., 208.66.172.56). DNS poisoning is a process in which an attacker provides fake data to a DNS server for the purpose of misdirecting users. For example, a malicious user who operates Web site ABC but wants to pose as Web site 123 could build up a DNS poisoning attack in order to put Web site ABC’s IP address into the entry for Web site 123. Users who use the DNS server that is “poisoned” to locate Web site 123 would then be served by Web site ABC’s IP address. The following are the steps involved in one DNS poisoning technique: 1. Set up a fake Web site on a computer. 2. Install TreeWalk and modify the file mentioned in the readme.txt to the computer’s IP address. TreeWalk will make this computer the DNS server. 3. Modify the file dns-spoofing.bat and replace the IP address with the computer’s IP address. 4. Trojanize the dns-spoofing.bat file and send it to another user. 5. When the user clicks the Trojaned file, it will replace the user’s DNS entry in his or her TCP/IP properties to that of your machine. 6. You will become the DNS server for the other user, and his or her DNS requests will go through the machine set up in step 1. 7. When the user tries to go to a certain Web site, the Web site he or she resolves to is the fake Web site. Then you can capture the password and send the user to the real Web site. The following are some of the types of DNS poisoning: • Intranet DNS spoofing (local network) • Internet DNS spoofing (remote network) • Proxy server DNS poisoning • DNS cache poisoning

2-8

Chapter 2

Intranet DNS Spoofing (Local Network) For this technique, the attacker must be connected to the local area network (LAN) and be able to sniff packets. This method works well against switches with ARP poisoning on the router. Figure 2-3 depicts the process of intranet DNS spoofing (local network).

Internet DNS Spoofing (Remote Network) This method of DNS spoofing works across networks and is relatively easy to set up and implement. Using this technique, the attacker sends a Trojan to the target machine and changes the machine’s DNS IP address to that of the attacker. Figure 2-4 depicts the process of Internet DNS spoofing (remote network).

Proxy Server DNS Poisoning This type of DNS poisoning works across networks and is easy to set up and execute. The attacker sends a Trojan to a user’s machine to change the proxy server settings on a machine to point to the attacker’s machine. Figure 2-5 depicts the process of proxy server DNS poisoning.

DNS Cache Poisoning To perform a cache poisoning attack, an attacker exploits a flaw in the DNS server software that can make it accept incorrect information. If the server does not correctly validate DNS responses to ensure that they have come from an authoritative source, the server will end up caching the incorrect entries locally and serve them to users that make the same request. For example, an attacker poisons the IP address DNS entries for a target Web

What is the IP address of www.xsecurity.com

Router IP: 10.0.0.254

Real Web site www.xsecurity.com IP: 200.0.0.45

DNS request Rebec

ca’s br

DN

Sr

es

po

owser co 10.0.0.5 nnects to

ns

e

m .co rity .0.5 ecu 0.0 .xs at 1 w ww cated is lo

Rebecca types www.xsecurity.com in her Web browser IP: 10.0.0.3

Hacker poisons the router and all the router traffic is forwarded to his machine

Hacker’s fake Web site sniffs the credential and redirects the request to real Web site Hacker sets up fake Web site www.xsecurity.com IP: 10.0.0.5

Hacker runs arpspoof/dnsspoof www.xsecurity.com

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 2-3 An attacker must be connected to the LAN to perform intranet DNS spoofing.

Real Web site www.xsecurity.com IP: 200.0.0.45 ww w. xs

W

Re ec bec ur DN ca’s ity S .co re t is DN bro ws m sp th S re er c is on e onn IP que loc se ect ad st at s to ed dr go 65. es es a 0.0 t6 s o to .2 5. f w 20 0 .0 ww 0. . 0 2 .xs .0 ec .2 ur ity .co m

Hacker’s fake Web site sniffs the credential and redirects the request to real Web site

ha

Rebecca types www.xsecurity.com in her Web browser

Hacker’s infects Rebecca’s computer by changing her DNS IP address to: 200.0.0.2

Fake Web site IP: 65.0.0.2

Hacker runs DNS server in Russia IP: 200.0.0.2 Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 2-4

An attacker uses a Trojan to perform Internet DNS spoofing.

Evidence Gathering from ARP Table

2-9

Real Web site www.xsecurity.com IP: 200.0.0.45

h ug ro th

Rebecca types www.xsecurity.com in her Web Browser

go ts es e qu in re ach eb m W ’s ’s er ca ack ec h eb

lR Al

Hacker’s fake Web site sniffs the credential and redirects the request to real Web site

Hacker sends Rebecca’s request to fake Web site

Hacker’s infects Rebecca’s computer by changing her JE Proxy address to: 200.0.0.2

Fake Web site IP: 65.0.0.2

Hacker runs proxy server in Russia IP: 200.0.0.2 Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 2-5 An attacker uses a Trojan to change the proxy server settings on a machine during a proxy server DNS poisoning attack.

Figure 2-6

The arp -a command displays the ARP table in Windows.

site on a given DNS server, replacing them with the IP address of a server the attacker controls. The attacker then creates fake entries for files on the server he or she controls with names matching those on the target server.

Evidence Gathering from ARP Table The ARP table of a router comes in handy for investigating network attacks, as the table contains the IP addresses associated with MAC addresses. An investigator can view the ARP table in Windows by issuing the command arp -a, as shown in Figure 2-6. An investigator can also refer to the ARP table to find out the MAC addresses. The ARP table maintained on the router is of crucial importance, as it can provide information about the MAC address of all the hosts that were involved in recent communications. The following are ways that an investigator can document the ARP table: • Taking a photograph of the computer screen • Taking a screenshot of the table and saving it on a disk • Using the HyperTerminal logging facility

2-10

Chapter 2

Evidence Gathering at the Data Link Layer: DHCP Database The DHCP database provides a means of determining the MAC address associated with the computer in custody. This database helps DHCP conclude the MAC address in case DHCP is unable to maintain a permanent log of requests. The DHCP server maintains a list of recent queries along with the MAC address and IP address. The database can be queried by giving the time duration during which the given IP address accessed the server.

Gathering Evidence from an IDS Monitoring network traffic is of prime importance. An administrator can configure an intrusion detection system (IDS) to capture network traffic when an alert is generated. However, this data is not a sufficient source of evidence because there is no way to perform integrity checks on the log files. In a network investigation, preserving digital evidence is difficult, as data is displayed on-screen for a few seconds. Investigators can record examination results from networking devices such as routers, switches, and firewalls through a serial cable and software such as the Windows HyperTerminal program or a script on UNIX. If the amount of information to be captured is large, an investigator can record the on-screen event using a video camera or a related software program. The disadvantage to this method is that there is no integrity check, making it difficult to authenticate the information.

Tool: Tcpdump Tcpdump is a powerful tool that extracts network packets and performs statistical analysis on those dumps. It operates by putting the network card into promiscuous mode. It may be used to measure the response time and packet loss percentages, and to view TCP/UDP connection establishment and termination. One major drawback to Tcpdump is that the size of the flat file containing the text output is large. The Tcpdump report consists of the following: • Captured packet count: This is the number of packets that Tcpdump has received and processed. • Received packet count: The meaning of this depends on the OS on which the investigator is running Tcpdump. It may also depend on the way the OS is configured. If a filter is specified on the command line, on some OSs it counts packets, regardless of whether they were matched by the filter expression and, even if they were matched by the filter expression, regardless of whether Tcpdump has read and processed them yet. • Count of packets dropped by kernel: This is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on which Tcpdump is running, if the OS reports that information to applications; if the OS does not report this information, Tcpdump will report it as zero. Tcpdump supports the following platforms: • SunOS 3.x or 4.x: The investigator must have read access to /dev/nit or /dev/bpf*. • Solaris: The investigator must have read/write access to the network pseudodevice, e.g., /dev/le. • HP-UX: The investigator must be root or Tcpdump must be installed setuid to root. • IRIX: The investigator must be root or Tcpdump must be installed setuid to root. • Linux: The investigator must be root or Tcpdump must be installed setuid to root. • Ultrix and Digital UNIX: Any user may capture network traffic with Tcpdump. However, no user (not even the super-user) can capture in promiscuous mode on an interface unless the super-user has enabled promiscuous-mode operation on that interface using pfconfig. • BSD: The investigator must have read access to /dev/bpf*. Figure 2-7 shows sample output from Tcpdump.

Tool: WinDump

2-11

Figure 2-7 Tcpdump shows information about all the packets that come through the network interface.

Tool: WinDump WinDump is a port of Tcpdump for the Windows platform. WinDump is fully compatible with Tcpdump and can be used to watch and diagnose network traffic according to various complex rules. WinDump is simple to use and works at the command-line level. Figure 2-8 shows the results of windump -n -S -vv. The -n option tells WinDump to display IP addresses instead of computer names. The -S option indicates that the actual TCP/IP sequence numbers should be shown (if this option is omitted, relative numbers will be shown). The -vv option makes the output more verbose, adding fields such as time to live and IP ID number to the sniffed information. The following is a TCP example that shows a data packet with the PUSH and ACK flags set: 20:50:00.037087 IP (tos 0x0, ttl 128, id 2572, and len 46) 192.168.2.24.1036 > 64.12.24.42.5190: P [tcp sum ok] 157351:157357(6) ack 2475757024 win 8767 (DF) The above entry can be deciphered in the following way: 20:50:00.037087 [time stamp] IP [protocol header follows] (tos 0x0, ttl 128, id 2572, len 46) 192.168.2.24.1036 [source IP:port] > 64.12.24.42.5190: [destination IP:port] P [push flag] [tcp sum ok] 157351:157357 [sequence numbers] (6) [bytes of data] ack 2475757024 [acknowledgement and sequence number] win 8767 [window size] (DF) [don’t fragment set] The next example is UDP: 20:50:11.190427 [time stamp] IP [protocol header follows] (tos 0x0, ttl 128, id 6071, len 160) 192.168.2.28.3010 [source IP:port] > 192.168.2.1.1900: [destination IP:port] udp [protocol] 132

2-12

Chapter 2

Figure 2-8 WinDump displays more verbose information when the user specifies the -vv option.

The following is an ICMP log entry: 20:50:11.968384 [time stamp] IP [protocol header follows] (tos 0x0, ttl 128, id 8964, len 60) 192.168.2.132 [source IP] > 192.168.2.1: [destination IP] icmp [protocol type] 40: [time to live] echo request seq 43783 [sequence number] Finally, WinDump can also capture ARP requests and replies, such as the following: 20:50:37.333222 [time stamp] arp [protocol] who-has 192.168.2.1 [destination IP] tell 192.168.2.118 [source IP] 20:50:37.333997 [time stamp] arp [protocol] reply 192.168.2.1 [destination IP] is-at 0:a0:c5:4b:52: fc [MAC address]

Tool: NetIntercept NetIntercept, from Sandstorm Enterprises, is a network analysis tool that allows an organization to increase its network security. NetIntercept captures LAN traffic using a standard Ethernet interface card placed in promiscuous mode and a modified UNIX kernel. The capture subsystem runs continuously, whether or not the GUI is active. Figure 2-9 shows a screenshot of captured traffic. NetIntercept performs stream reconstruction on demand. When the user selects a range of captured network traffic to analyze, NetIntercept assembles those packets into network connection data streams. The reconstructed streams are then presented to the NetIntercept analysis subsystem for identification and analysis. Once TCP streams are reconstructed and parsed, some of the objects that they contain need to be stored for long periods, e.g., Web pages, files transferred by FTP, and e-mail attachments. Aside from controlling data capture and analysis, the GUI offers sophisticated search criteria. A user can find one or many network connections according to the following: • • • • • • •

Time of day Source or destination hardware or Internet address Source or destination TCP or UDP port name or number Username associated with the connection E-mail sender, recipient(s), or subject header File name or World Wide Web URL associated with the transfer Specific protocols or content types recognized in the connection contents

Once a connection has been identified, the user can drill down to view the search criteria extracted from it, as shown in Figure 2-10.

Tool: Wireshark

Figure 2-9

Figure 2-10

2-13

NetIntercept captures traffic continuously.

A user can look at the contents of a connection once it has been identified.

Tool: Wireshark Wireshark, formerly known as Ethereal, is a GUI-based network protocol analyzer. It lets the user interactively browse packet data from a live network or from a previously saved capture file. Wireshark’s native capture file format is the libpcap format, which is also the format used by Tcpdump and various other tools. In addition, Wireshark can read capture files from snoop and atmsnoop, Shomiti/Finisar Surveyor, Novell LANalyzer,

2-14

Chapter 2

Figure 2-11

Wireshark can show information about all captured packets.

Network General/Network Associates DOS-based Sniffer (compressed or uncompressed), Microsoft Network Monitor, and other tools. Wireshark can determine the capture file type by itself, without user intervention. It is also capable of reading any of these file formats if they are compressed using gzip. Like other protocol analyzers, Wireshark’s main window shows three views of a packet. It shows a summary line, briefly describing what the packet is. It also shows a protocol tree, allowing the user to drill down to the exact protocol, or field, that he or she is interested in. Finally, a hex dump shows the user exactly what the packet looks like when it goes over the wire. Wireshark has other features. It can assemble all the packets in a TCP conversation and show the user the ASCII (or EBCDIC, or hex) data in that conversation. Packet capturing is performed with the pcap library. The capture filter syntax follows the rules of the pcap library. This syntax is different from the display filter syntax. Compressed file support uses the zlib library. The following are some of the other features of Wireshark: • Data can be captured off the wire from a live network connection or read from a captured file. • Live data can be read from Ethernet, FDDI, PPP, Token Ring, IEEE 802.11, and loopback interfaces. • Captured network data can be browsed using a GUI or by using the TTY mode. • Captured files can be programmatically edited or converted via command-line switches. • Output can be saved or printed as plain text or PostScript. • Data display can be refined using a display filter. • Display filters can also be used to selectively highlight and color packet summary information. • All or part of each captured network trace can be saved to a disk. Figure 2-11 shows a screenshot from Wireshark.

Tool: CommView CommView is a network monitor and analysis tool that provides a complete picture of the traffic flowing through a PC or LAN segment. It captures every packet on the wire and displays information and vital statistics about the captured packets, as shown in Figure 2-12. A user can examine, save, filter, import, and export captured packets.

Tool: SoftPerfect Network Protocol Analyzer

Figure 2-12

2-15

CommView shows detailed information about every captured packet.

For remote monitoring, CommView includes an add-on called the Remote Agent. It allows CommView users to capture network traffic on any computer where Remote Agent is running, regardless of the computer’s physical location. CommView allows users to do the following: • View detailed statistics about IP addresses, ports, and sessions • Reconstruct TCP sessions • Map packets to the sending or receiving application • View protocol distribution, bandwidth utilization, and network node charts and tables • Generate network traffic reports in real time • Browse captured and decoded packets in real time • Search for strings or hex data in captured packet contents • Import and export packets in multiple formats • Configure alarms that can notify the user about important events, such as suspicious packets, high bandwidth utilization, and unknown addresses • Create plug-ins for decoding any protocol • Exchange data with applications over TCP/IP • Export any IP address to SmartWhois for quick, easy IP lookup • Capture loopback traffic

Tool: SoftPerfect Network Protocol Analyzer SoftPerfect Network Protocol Analyzer debugs, maintains, analyzes, and monitors local networks and Internet connections. It captures the data passing through network connections, analyzes this data, and then represents it in an easily readable form. The SoftPerfect Network Protocol Analyzer presents analysis results

2-16

Chapter 2

in an easily understandable format. It also allows a user to defragment and reassemble network packets into streams. The tool can analyze network traffic based on a number of different Internet protocols, such as the following: • AH • ARP • ESP • FTP • HTTP • ICMP • ICMPv6 • IMAP • IP • IPv6 • IPX • LLC • MSG • POP • REVARP • RIP • SAP • SER • SMTP • SNAP • SPX • TCP • Telnet • UDP A user can filter network traffic so he or she is only presented with the traffic he or she is concerned with. The SoftPerfect Network Protocol Analyzer also features a packet builder. This tool allows the user to build custom network packets and send them over the network. With this feature, the user can check the network for protection against attacks and intruders. The software supports all 32-bit and 64-bit versions of Windows. The following are some of the features of SoftPerfect Network Protocol Analyzer: • It can work in promiscuous mode to capture all network packets (Figure 2-13). • It has a flexible system of traffic filtering. Any filter can be inclusive or exclusive. • It can reconstruct packets into flows so the user can easily see a complete data exchange following Telnet, POP3, SMTP, IMAP, FTP, HTTP, and other protocols. Figure 2-14 shows a reconstructed HTTP stream. • It supports SMP systems (with two or more CPUs), as well as HT-enabled systems. • It is able to monitor loopback connections within the computer.

Tool: HTTP Sniffer EffeTech HTTP Sniffer is an HTTP packet sniffer, protocol analyzer, and file reassembly tool for Windows. This sniffer captures IP packets containing HTTP messages, rebuilds the HTTP sessions, and reassembles files sent through HTTP. HTTP Sniffer provides real-time analysis of content while capturing, analyzing, parsing, and decoding HTTP messages.

Tool: HTTP Sniffer

Figure 2-13 SoftPerfect Network Protocol Analyzer displays information about all packets captured from the network.

Figure 2-14

SoftPerfect Network Protocol Analyzer can reconstruct an entire data exchange.

2-17

2-18

Chapter 2

Figure 2-15

HTTP Sniffer displays information about captured HTTP packets.

The following are some of the features of HTTP Sniffer: • Powerful HTTP file rebuilder: HTTP Sniffer recognizes the reconstructed stream of each TCP session. Through analysis of the HTTP packets in the same TCP connection, it reassembles the original files transferred by HTTP. The user can view and save the rebuilt files. • Multiple file-type support: The tool supports HTML, XML, GIF, JPG, and other file types. • Powerful packet-capturing filter: This feature provides a flexible mechanism to monitor specific target host and file types. • Customized logging: HTTP Sniffer exports log files in HTML format or a customized CSV format. Figure 2-15 shows a screenshot from HTTP Sniffer.

Tool: EtherDetect Packet Sniffer EtherDetect Packet Sniffer is a connection-oriented packet sniffer and network protocol analyzer. A user can capture full packets, organize packets by TCP connections or UDP threads, passively monitor the network, and view packets in hex format. The following are some of the features of EtherDetect Packet Sniffer: • Captures IP packets on a LAN with nearly no packet loss • Enables on-the-fly content viewing while capturing and analyzing • Parses and decodes a variety of network protocols • Supports saving captured packets for viewing at a later time

Tool: Iris Network Traffic Analyzer

2-19

Figure 2-16 EtherDetect Packet Sniffer provides syntax highlighting for application data, including HTTP data, as shown here.

• Provides a flexible filtering mechanism to capture specific packets • Provides syntax highlighting for application data in the HTML, HTTP, and XML formats, as shown in Figure 2-16

Tool: OmniPeek OmniPeek is a network analysis tool that an administrator can use to quickly analyze and troubleshoot network problems at the enterprise level. The following are some of the features of OmniPeek: • Ability to analyze traffic from any local network segment, including gigabit and WAN segments • Ability to drill down to see which network nodes are communicating, which protocols and subprotocols are being transmitted, and which traffic characteristics are affecting network performance • Ability to change filters on the fly without having to stop and restart packet captures • Ability to view packet-stream-based analytics by conversation pair • Ability to view local captures, remote captures, or a combination of local and remote captures • Ability to simultaneously monitor multiple parts of the network • Ability to analyze and troubleshoot VoIP traffic Figures 2-17 and 2-18 show screenshots from OmniPeek.

Tool: Iris Network Traffic Analyzer Iris Network Traffic Analyzer provides network traffic analysis and reporting functionality. This tool captures network traffic and can automatically reassemble it to its native format, making it much easier to analyze the

2-20

Chapter 2

Figure 2-17

OmniPeek provides different views of captured packets.

Figure 2-18

OmniPeek provides users with visuals concerning network traffic.

data going across the network. An investigator can read the actual text of an e-mail exactly as it was sent, or reconstruct exact HTML pages that a user has visited. An investigator can configure Iris Network Traffic Analyzer to capture only specific data through any combination of packet filters. Packet filters can be based on hardware or protocol layers, any number of keywords, MAC or IP addresses, source and destination ports, custom data, and packet sizes. Figure 2-19 shows a screenshot from Iris Network Traffic Analyzer.

Tool: NetSetMan

2-21

Figure 2-19 Iris Network Traffic Analyzer allows a user to view details about captured packets.

Tool: SmartSniff SmartSniff provides investigators with the ability to view captured TCP/IP packets as sequences of conversations between clients and servers. Investigators can view these conversations in ASCII mode (for text-based protocols) or as a hex dump for non-text-based protocols). The following are some of the features of SmartSniff: • Color coding of local and remote traffic • Exporting to HTML and other formats • A basic, but very small and standalone, protocol analyzer Figure 2-20 shows a screenshot from SmartSniff.

Tool: NetSetMan NetSetMan is a network settings manager that allows a user to easily switch between six different network settings profiles. These profiles include the following settings: • IP address • Subnet mask • Default gateway • Preferred and alternate DNS servers • Computer name • Workgroup • DNS domain • WINS server • Default printer

2-22

Chapter 2

Figure 2-20 protocols.

Figure 2-21

SmartSniff shows ASCII views of network conversations for text-based

NetSetMan allows a user to switch between sets of network settings.

• Run scripts • Network domain • Complete proxy settings (Internet Explorer and Firefox) • Home page (Internet Explorer and Firefox) Figure 2-21 shows a screenshot from NetSetMan.

Tool: MaaTec Network Analyzer

Figure 2-22

2-23

Distinct Network Monitor displays live network traffic statistics.

Tool: Distinct Network Monitor Distinct Network Monitor displays live network traffic statistics, as shown in Figure 2-22. It includes a scheduler that allows an administrator to run a scheduled collection of network traffic statistics or packet captures. The following are some of the features of Distinct Network Monitor: • Network protocols have a drill-down capability showing all the local hardware addresses that generated the packets. • The reporting feature allows a user to create statistics reports in HTML and CSV formats. • A user can discover which ports on a system are open and listening for a connection.

Tool: MaaTec Network Analyzer MaaTec Network Analyzer is a tool that is used for capturing, saving, and analyzing network traffic. The following are some of the features of MaaTec Network Analyzer: • Real-time network traffic statistics • Scheduled network traffic reports • Online view of incoming packets • Multiple data color options (Figure 2-23)

2-24

Chapter 2

Figure 2-23

MaaTec Network Analyzer can color-code data based on different criteria.

Tool: ntop ntop is a network traffic probe that shows network usage. In interactive mode, it displays the network status on the user’s terminal. In Web mode, it acts as a Web server, creating an HTML dump of the network status, as shown in Figure 2-24.

Tool: EtherApe EtherApe is a graphical network monitor for UNIX. It displays network activity graphically by featuring link layer, IP, and TCP modes, as shown in Figure 2-25. It can filter traffic for display, and it can read traffic from a file as well as live from the network.

Tool: Colasoft Capsa Network Analyzer Colasoft Capsa Network Analyzer is a TCP/IP network sniffer and analyzer that offers real-time monitoring and data analysis of network traffic. It also offers e-mail analysis, Web analysis, and transaction analysis. Figure 2-26 shows a screenshot from Colasoft Capsa Network Analyzer.

Tool: Colasoft Capsa Network Analyzer

Figure 2-24

Figure 2-25

ntop displays network statistics on a Web page.

EtherApe creates a graphical display of network traffic.

2-25

2-26

Chapter 2

Figure 2-26 Colasoft Capsa Network Analyzer provides statistics about network traffic.

Tool: Colasoft EtherLook Colasoft EtherLook is a TCP/IP network-monitoring tool for Windows-based platforms. It monitors real-time traffic flowing around local networks, and to and from the Internet. The Traffic Analysis Module allows a user to capture network traffic in real time, and display data received and sent by every host in a LAN, as shown in Figure 2-27. It also includes three advanced analysis modules: • E-Mail Analysis Module: Captures e-mail messages and restores their contents • Web Analysis Module: Allows for detailed tracking of Web accesses from the network • Login Analysis Module: Analyzes all data logins within the network and records all related data

Tool: AnalogX PacketMon AnalogX PacketMon allows an administrator to capture IP packets that pass through a network interface, whether those packets originated from the machine on which PacketMon is installed or from any other machine on the network. Administrators can then use the built-in viewer to examine the packet’s header and contents. PacketMon can export the results into a CSV file for further processing. Figure 2-28 shows a screenshot from AnalogX PacketMon.

Tool: BillSniff

Figure 2-27

2-27

Colasoft EtherLook displays all the data received by every host in a LAN.

Tool: BillSniff BillSniff is a network protocol analyzer that provides detailed information about current traffic, as well as overall protocol statistics. It supports the following protocols: • IPv4 • TCP • UDP • IEEE 802.2 frame • Ethernet II frame • NetBIOS • IPX BillSniff includes both real-time monitoring and an extensive array of filter options that allows a user to limit capture based on IP address, port, protocol, MAC address, packet size, and other criteria. BillSniff also provides graphical statistics for network layers. Users can also send packets and script custom protocols with BillSniff. Figure 2-29 shows a screenshot from BillSniff.

2-28

Chapter 2

Figure 2-28

Figure 2-29 of packets.

AnalogX PacketMon can show detailed information about packets.

BillSniff allows a user to view hexadecimal and ASCII versions

Tool: Sniphere

Figure 2-30

2-29

IE HTTP Analyzer displays its information in a separate frame within Internet Explorer.

Tool: IE HTTP Analyzer IE HTTP Analyzer is an add-in for Internet Explorer that allows a user to capture HTTP and HTTPS traffic in real time. It displays the following information: • Headers • Content • Cookies • Query strings • Post data • Redirection URLs • Cache information • HTTP status code information It also provides session clearing and several filtering options. Figure 2-30 shows a screenshot from IE HTTP Analyzer.

Tool: EtherScan Analyzer EtherScan Analyzer is a network traffic and protocol analyzer. It captures and analyzes packets sent over a local network. It decodes the major protocols and is capable of reconstructing TCP/IP sessions.

Tool: Sniphere Sniphere is a WinPcap network sniffer that supports most common protocols. It can be used on Ethernet devices and supports PPPoE modems. It allows the user to set filters based on IP, MAC address, ports, and protocols,

2-30

Chapter 2

Figure 2-31

Sniphere can filter traffic based on several criteria.

and it also decodes packages into an easy-to-understand format. In addition, users can save session logs in XML format and copy selected packets to the clipboard. Figure 2-31 shows a screenshot from Sniphere.

Tool: IP Sniffer IP Sniffer is a protocol analyzer that uses Windows XP/2000 raw socket features. It supports filtering rules, adapter selection, packet decoding, advanced protocol description, and more. It provides detailed information about each packet in a tree-style view, and the right-click menu allows users to resolve or scan a selected source IP address. IP Sniffer provides the following additional features: • Adapter statistics • IP traffic monitoring • Traceroute • Ping • Port scanning • TCP/UDP/ICMP spoofing options • Opens TCP/UDP ports attached to a process • MAC address changing • DNS/WINS/SNMP/WHOIS/DHCP queries Figure 2-32 shows a screenshot from IP Sniffer.

Tool: Atelier Web Ports Traffic Analyzer Atelier Web Ports Traffic Analyzer is a network traffic sniffer and logger that allows a user to monitor all Internet and network traffic on a PC and view the actual content of the packets. It provides real-time mapping of ports to processes. It also shows the history since boot time of every TCP, UDP, or RAW port opened through Winsock. Figure 2-33 shows a screenshot from Atelier Web Ports Traffic Analyzer.

Tool: Atelier Web Ports Traffic Analyzer

Figure 2-32

IP Sniffer provides graphical statistics about network traffic.

Figure 2-33 Atelier Web Ports Traffic Analyzer shows hexadecimal and ASCII versions of the content of packets.

2-31

2-32

Chapter 2

Figure 2-34 IPgrab’s verbose mode displays a lot of information about each packet.

Tool: IPgrab IPgrab is a packet sniffer for UNIX hosts. It provides a verbose mode that displays a great amount of information about packets. It also provides a minimal mode in which all information about all parts of a packet is displayed in a single line of text. Figure 2-34 shows a screenshot from IPgrab.

Tool: Sniff-O-Matic

2-33

Tool: Nagios Nagios is a host and service monitor designed to run under the Linux operating system. The following are some of the features of Nagios: • Monitoring of network services (SMTP, POP3, HTTP, NNTP, ping, etc.) • Monitoring of host resources (processor load, disk and memory usage, running processes, log files, etc.) • Web interface for viewing current network status, notification and problem history, log files, etc. • Support for implementing redundant and distributed monitoring servers Figure 2-35 shows a screenshot from Nagios.

Tool: Give Me Too Give Me Too is a packet sniffer, network analyzer, and network sniffer that monitors any Internet and e-mail activity. It captures all data transferred through the network via HTTP, FTP, SMTP, IMAP, POP3, and IRC protocols. Figure 2-36 shows a screenshot from Give Me Too.

Tool: Sniff-O-Matic Sniff-O-Matic is a network protocol analyzer and packet sniffer. It captures network traffic and provides analysis tools that allow a user to analyze the captured data. Figure 2-37 shows a screenshot from Sniff-O-Matic.

Figure 2-35

Nagios can display details about the current network status.

2-34

Chapter 2

Figure 2-36

Using Give Me Too, users can open files that have been transferred over the network.

Figure 2-37

Sniff-O-Matic shows the entire contents of each packet.

Tool: GPRS Network Sniffer: Nokia LIG

Figure 2-38

2-35

EtherSnoop allows users to choose which packets to see in a more detailed view.

Tool: EtherSnoop EtherSnoop is a packet sniffer and protocol analyzer. It captures the data passing through a dial-up connection or Ethernet card, analyzes the data, and presents it in a readable format. Figure 2-38 shows a screenshot from EtherSnoop.

Tool: GPRS Network Sniffer: Nokia LIG In the General Packet Radio Service (GPRS) embedding of the Lawful Interception Gateway (LIG), critical network functionality enables interception of GPRS mobile data calls. This technique is entirely different from GSM call interception. The difference lies in interception. In GSM, voice-based audio recording is primarily intercepted, whereas in GPRS, the data between the mobile station and the access point is captured. The Nokia LIG provides a precise solution for constructing the GPRS interception system. In Nokia’s execution, the Lawful Interception Controller (LIC) network element communicates with the ADMF (Administration Function), and the Lawful Interception Browser (LIB) element communicates with the delivery functions DF2 and DF3 of the ETSI standard. The architecture of Nokia’s implementation comprises the following: • Lawful Interception Controller (LIC): This component is based on the Nokia/IPRG IP650 router product. It monitors data interception and provides secured Web interfaces for various lawful enforcement agencies (LEAs) and the authorization authorities (AAs). • Lawful Interception Browser (LIB): This component is also based on the Nokia/IPRG IP650 router product. It keeps interception-related information and communication content (CC) temporarily that are sent in the same form to the defined LEA(s).

2-36

Chapter 2

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 2-39

The LIC, LIB, and LIE all work together in the Nokia LIG.

• Lawful Interception Extension (LIE): This component is based on the GGSN Release 1.1 software. Its primary role is to gather part of the IRI and accumulate the communication content, mainly the user (mobile) data transmitted. Figure 2-39 shows how these components work together.

Tool: Siemens Monitoring Center Siemens Monitoring Center is designed for law enforcement and government security agencies. Its design permits integration within all telecommunications networks that use any type of modern standardized equipment compatible with an ETSI recommendation (e.g., Siemens, Ericsson, Alcatel, Nokia, Nortel, Lucent, and Huawei). With the help of the Siemens Intelligence Platform, analysts may find meaning among large reams of irrelevant data. The Intelligence Platform is a means to organize disparate pieces of information for the law enforcement and security agencies so decision makers can act upon the information. Siemens Monitoring Center provides all monitoring requirements within telecommunication networks, including the following: • Fixed networks: PSTN (local and international exchanges) • Mobile networks: GSM, GPRS, UMTS • Next-generation networking (NGN) • IP networks (local loop, ISP, and Internet backbone) • Automatic correlation of content of communication to IRI • Mono and stereo, optionally compressed, voice recording • Full duplex/no compression recording for data demodulation (fax, Internet, e-mails, etc.) • Customized add-on applications • Centralized or distributed Monitoring Center (Monitoring Center to-go)

Tool: NetWitness

2-37

• Scalable and adaptable to customer requirements • Joint roadmap for upcoming telecommunications technology

Tool: NetWitness NetWitness analyzes network traffic for potential threats. The primary focus of NetWitness is on expanding the efficiency of information gathering. It enables organizations to recognize and respond to network activity promptly. NetWitness performs a threat assessment of the Web, voice, file access, chat, and database sessions from any packet source. It presents data at the application layer, which removes the necessity of low-level packet inspection. The comprehensive packet filtering features enable the filtering of analysis logs during the collection phase. Implementation of application rules can generate a number of events, such as real-time alerts and information logging. These facilities can be employed to observe parameters that are set to meet specific legal requirements. NetWitness brings together large collections of data and combines them with data intercepted from other systems, which allows administrators to have an extensive understanding of the trends in network traffic. This feature of NetWitness makes filtering of the search and monitoring functions easy. The following are modes in which NetWitness can work: • Stealth mode: In an intrusion attack, NetWitness hides its presence from detection by the intruder, but only if it is working on an Ethernet-based network. • Real-time mode: This mode monitors network traffic. • File mode: This mode analyzes the files captured from a different machine. • Archival mode: This mode ensures the storage of compressed logs of captured data for later analysis. Figure 2-40 shows a screenshot from NetWitness.

Figure 2-40 NetWitness allows users to view files captured from other machines on the network.

2-38

Chapter 2

Figure 2-41

Users can view reconstructed Web pages using NetResident.

Tool: NetResident NetResident captures, stores, analyzes, and reconstructs network events, such as e-mail messages, Web pages, downloaded files, instant messages, and VoIP conversations. NetResident captures the data on the network, saves it to a database, reconstructs it, and displays this content in an easy-to-understand format. NetResident focuses on the high-level protocols used to transfer content over networks. Network administrators can use NetResident to enforce IT policy, and forensic investigators can use it to gain crucial information. Figure 2-41 shows a screenshot from NetResident.

Tool: InfiniStream InfiniStream provides the ability to identify, monitor, measure, and resolve high-impact, intermittent enterprise problems. InfiniStream’s continuous long-term capture ability enables users to have data for an entire transaction or a series of transactions. Users can then drill down to the area of interest and conduct a postcapture analysis using sniffer decodes and analysis. InfiniStream provides streaming capture performance and flexible data mining for the following: • Real-time analysis • Back-in-time analysis • Historical analysis, in conjunction with Sniffer Enterprise Visualizer

Tool: eTrust Network Forensics

2-39

The following are some of the features of InfiniStream: • 10 GbE capture and analysis: The 10 GbE appliance provides a sustained 10 GbE full-duplex capture and analysis for troubleshooting backbones and vital network segments. Plus, it offers 24⫻7 visibility to resolve high-impact network issues before they affect the network. • Web-based user interface (UI) option: This flexible UI allows users to access reports from anywhere on the network, serving actionable data to help users make critical business decisions. • WAN topology support: Using the WAN/ATM SuperTAP, users can better understand the health and condition of their WAN links and provide end-to-end coverage of vital network segments, from LAN to WAN. The WAN/ATM SuperTAP provides the ability to passively connect into any of the following WAN link types: DS-3 Clear Channel, WAN HSSI, ATM DS-3, and ATM OC-3. • Real-time statistical monitoring and alerting: This enables users to learn about a potential problem before it becomes business critical. • High-performance enhanced four-port gigabit hardware option: This is a customized four-port analysis card that ensures sustained full-duplex line-rate capture with hardware assist on the i1620 appliance for highly utilized gigabit segments. Figures 2-42 and 2-43 show screenshots from InfiniStream.

Tool: eTrust Network Forensics eTrust Network Forensics helps an organization secure its network and ensure availability by capturing realtime network data to identify how business assets are affected by network exploits, internal data theft, and security or HR policy violations. eTrust Network Forensics can help the organization mitigate risk, comply with regulations, and reduce analysis and investigation costs by allowing IT and security staff to visualize network activity, uncover anomalous traffic, and investigate security breaches.

Figure 2-42

InfiniStream captures packets from the network.

2-40

Chapter 2

Figure 2-43 InfiniStream shows various types of charts describing statistics about network traffic.

The following are some of the features of eTrust Network Forensics: • Network traffic recording and visualization: eTrust Network Forensics promiscuously monitors and records network traffic in all seven layers of the OSI stack in real time, and uses advanced visualization tools to create a picture of communication flows to swiftly expose anomalies, illegal connections, and security and network problems. • Real-time network data capture: eTrust Network Forensics promiscuously monitors more than 1,500 protocols and services out of the box, and records network activity in real time into a central database that can be queried, providing a complete view of how network communications are impacting security and availability. • Advanced visualization: eTrust Network Forensics helps administrators detect anomalies or trouble spots by transforming raw network data into actionable knowledge. It generates interactive graphical representations of the series of events representing the propagation of an attack or other suspicious activity. • Pattern and content analysis: eTrust Network Forensics visualizes and depicts abnormal usage, and analyzes e-mails, keywords, images, or other references to reveal improper data exchange or leakage. • Communications catalog: eTrust Network Forensics stores and catalogs network packets in real time into a centralized knowledge base that administrators can query. • On-demand incident playback: On-the-fly session reassembly enables you to quickly associate the communicators based on addresses, domains, protocols, users, hardware vendors, and more. • Advanced security investigation: eTrust Network Forensics uses advanced forensics investigation tools to diagnose network activities, allowing auditors, law enforcement agents, and enterprise security teams

Tool: P2 Enterprise Shuttle

Figure 2-44

2-41

eTrust Network Forensics captures and analyzes network traffic in real time.

to efficiently build critical intelligence to uncover anomalies, rebuild crime patterns, and review network asset utilization, architecture, and security policies. Figure 2-44 shows a screenshot from eTrust Network Forensics.

Tool: ProDiscover Investigator ProDiscover Investigator investigates disk contents throughout the network. It checks for illegal activity and for compliance with company policies. ProDiscover Investigator can gather evidence for potential use in legal proceedings. The following are some of the features of ProDiscover Investigator: • Extracts Internet history • Utilizes Perl scripts to automate investigation tasks • Saves travel costs by forensically examining live systems Figure 2-45 shows a screenshot from ProDiscover Investigator.

Tool: P2 Enterprise Shuttle P2 Enterprise Shuttle is an enterprise investigation tool that views, acquires, and searches client data wherever it resides in an enterprise. It checks the main communication pass-through for the system as well as the routers and firewalls. P2 Enterprise Shuttle acts as the central repository for all forensic images collected and is integrated with MySQL.

2-42

Chapter 2

Figure 2-45 ProDiscover Investigator inspects disk contents around the network for illegal content.

Figure 2-46

Show Traffic shows a continuous display of network traffic.

Tool: Show Traffic Show Traffic monitors network traffic on a user-specified network interface and displays it continuously. It allows a user to find suspicious network traffic or just monitor the traffic flowing through the network interface. Figure 2-46 shows a screenshot from Show Traffic.

Tool: Snort Intrusion Detection System

Figure 2-47

2-43

Network Probe provides a graphical summary of network traffic.

Tool: Network Probe Network Probe identifies the source of network slowdowns and other problems. It shows who is generating troublesome traffic, and where the traffic is being transmitted to or received from. Figure 2-47 shows a screenshot from Network Probe.

Tool: Snort Intrusion Detection System Snort is a software-based, real-time network intrusion detection system that notifies an administrator of a potential intrusion attempt. Snort is nonintrusive, is easily configured, and utilizes familiar methods for rule development. Snort has the ability to detect more than 1,100 potential vulnerabilities. Snort includes the following features: • Detects, based on pattern matching, threats including buffer overflows, stealth port scans, CGI attacks, SMB probes, NetBIOS queries, port scanners, well-known backdoor and system vulnerabilities, DDoS clients, and many more • Uses syslog, SMB messages, or a file to alert an administrator • Develops new rules quickly once the pattern (attack signature) is known for a vulnerability • Records packets from the offending IP address in a hierarchical directory structure, in humanreadable form • Records the presence of traffic that should not be found on the network Snort uses the libpcap library, the same library that Tcpdump uses to perform its packet sniffing. Snort decodes all the packets passing through the network to which it is attached, by entering promiscuous mode. Based upon the content of the individual packets and rules defined in the configuration file, Snort generates an alert.

2-44

Chapter 2

Snort Rules There are a number of rules that Snort allows a user to write. Each of these Snort rules must describe the following: • Any violation of the security policy of the company that might be a threat to the security of the company’s network and other valuable information • All the well-known and common attempts to exploit the vulnerabilities in the company’s network • The conditions in which a user thinks that the identity of a network packet is not authentic Snort rules are written for both protocol analysis and content searching and matching. The rules should be robust, meaning the system should keep a rigid check on the activities taking place in the network, and notify the administrator of any potential intrusion attempt. The rules should also be flexible, meaning that the system must be compatible enough to act immediately and take the necessary remedial measures if there is an intrusion. There are two basic principles that a user must keep in mind while writing Snort rules. They are as follows: • Principle 1: No written rule should extend beyond a single line, so that the rules are short, precise, and easy to understand. • Principle 2: Each rule should be divided into two logical sections: • The rule header, which contains the rule’s action, the protocol, the source and destination IP address, the source and destination port information, and the CIDR (classless interdomain routing) block • The rule options, which includes alert messages and information about which part of the packet should be inspected to determine whether the rule action should be taken The following illustrates a sample example of a Snort rule: Alert tcp any -> 192.168.1.0/24 111 (Content: “ | 00 01 86 a5 | ” ; msg: “mountd access” ; ) Figure 2-48 shows how Snort fits into a network.

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 2-48

Snort is a powerful IDS that allows users to write new rules.

Documenting the Evidence Gathered on a Network

2-45

Tool: IDS Policy Manager The IDS Policy Manager manages Snort IDS sensors in a distributed environment. Users can modify the configuration files using a GUI. Users can manage Snort by merging new rule sets, managing preprocessors, configuring output modules, and securely copying rules to sensors. The following are some of the features of Snort: • Ability to update rules via the Web • Can manage multiple sensors with multiple policy files • Can upload policy files via SFTP and FTP • Supports external rule set for BleedingSnort and Snort Community rules • Can learn details about a signature from popular databases such as CVE, BugTraq, McAfee, and Snort.org Reference Figures 2-49 and 2-50 show screenshots from IDS Policy Manager.

Documenting the Evidence Gathered on a Network In any investigation, it is necessary to maintain a chain of custody. In a network investigation, an investigator is required to document the gathered evidence. Documenting the evidence gathered on a network is easy if the network logs are small, as a printout can be taken and tested. But the process of documenting digital evidence on a network becomes more complex when the evidence is gathered from systems that are in remote locations because of the unavailability of date and time stamps of the related files.

Figure 2-49

IDS Policy Manager allows users to manage multiple Snort policies.

2-46

Chapter 2

Figure 2-50

Users can view and edit the details of a Snort rule with IDS Policy Manager.

The investigator should document the evidence-gathering process by listing the name of the person who collected the evidence, from where it was collected, the procedure used to collect the evidence, and the reason for collecting the evidence. If the evidence resides on a remote computer, detailed information about collection and location should be documented. The investigator should specify the server containing the data to avoid confusion. For documentation and integrity of the document, it is advisable to follow a standard methodology. To support the chain of custody, the investigator should print out screenshots of important items and attach a record of actions taken during the collection process.

Evidence Reconstruction for Investigation Gathering evidence on a network is cumbersome for the following reasons: • Evidence is not static and not concentrated at a single point on the network. • The variety of hardware and software found on the network makes the evidence-gathering process more difficult. Once the evidence is gathered, it can be used to reconstruct the crime to produce a clearer picture of the crime and identify the missing links in the picture. The following are three fundamentals of reconstruction for investigating a crime: 1. Temporal analysis: Temporal analysis produces a sequential event trail, which sheds light on important factors such as what happened and who was involved. Usage patterns, such as a histogram or time grid, can show redundancies and deviations, which can relate to high-priority activity requiring immediate attention. 2. Relational analysis: Relational analysis correlates the actions of suspect and victim. Once the relations are determined, it becomes easier to reconstruct the activities. Diagrams, such as association or relational,

Review Questions

2-47

can reveal important links. Relational analysis is best suited for a small number of entities, but for a large number, the process becomes complex. 3. Functional analysis: Functional analysis provides a description of the possible conditions of a crime. It testifies to the events responsible for a crime in relation to their functionalities. This analysis determines how things actually happened and what factors are responsible. Functional analysis presents the possible pattern of crime and fills in the gaps in the crime picture.

Chapter Summary ■

There are two types of network addressing schemes: LAN addressing and Internetwork addressing.

■

Sniffing tools are software or hardware that can intercept and log traffic passing over a digital network or part of a network.

■

The ARP table of a router comes in handy for investigating network attacks, as the table contains IP addresses associated with the respective MAC addresses.

■

The DHCP server maintains a list of recent queries, along with the MAC address and IP address.

■

An administrator can configure an IDS to capture network traffic when an alert is generated.

Review Questions 1. Describe the two network addressing schemes. _____________________________________________________________________________________________ _____________________________________________________________________________________________ 2. Why was the OSI model developed? What problem did it solve? _____________________________________________________________________________________________ _____________________________________________________________________________________________ 3. Describe the two types of Ethernet environments. _____________________________________________________________________________________________ _____________________________________________________________________________________________ 4. Describe the functions of the different layers of the OSI model. _____________________________________________________________________________________________ _____________________________________________________________________________________________ 5. Describe the different types of DNS poisoning. _____________________________________________________________________________________________ _____________________________________________________________________________________________ 6. Why is it difficult to reconstruct evidence for a network investigation? _____________________________________________________________________________________________ _____________________________________________________________________________________________ 7. What three types of analysis must an investigator perform during evidence reconstruction? _____________________________________________________________________________________________ _____________________________________________________________________________________________

2-48

Chapter 2

8. How is the ARP table useful in a network investigation? _____________________________________________________________________________________________ _____________________________________________________________________________________________

Hands-On Projects 1. Perform the following steps: ■

Navigate to Chapter 2 of the Student Resource Center.

■

Install WinDump.

■

Run WinDump in a command shell.

■

View the captured packets (Figure 2-51).

Figure 2-51

WinDump displays details about captured packets.

2. Perform the following steps: ■

Navigate to Chapter 2 of the Student Resource Center.

■

Install and launch Iris Network Traffic Analyzer.

Hands-On Projects

■

Click on the green Go arrow (Figure 2-52).

Figure 2-52

■

The Go arrow starts traffic capturing.

After a few minutes, click on the red Stop rectangle (Figure 2-53).

Figure 2-53

Hit the Stop button once you have acquired enough traffic data.

2-49

2-50

Chapter 2

■

Click on the Protocol Distribution Statistics button (Figure 2-54).

Figure 2-54 The Protocol Distribution Statistics screen shows statistics about the captured traffic.

■

View the graphical representation of network traffic (Figure 2-55).

Figure 2-55 of data.

Iris Network Traffic Analyzer can display a graphical representation

Hands-On Projects

3. Perform the following steps: ■

Navigate to Chapter 2 of the Student Resource Center.

■

Install and launch OmniPeek.

■

Start the capture and click the Packets option under Capture (Figure 2-56).

Figure 2-56

The Packets screen shows information about captured packets.

2-51

2-52

Chapter 2

■

Click the Log option under Capture (Figure 2-57).

Figure 2-57

The Log screen displays a lot of capturing activity.

Hands-On Projects

■

Click the Filters option under Capture (Figure 2-58).

Figure 2-58

The Filters screen allows a user to filter traffic data.

2-53

2-54

Chapter 2

■

Click the Hierarchy option under Expert (Figure 2-59).

Figure 2-59 ■

The Hierarchy screen shows a hierarchical view of traffic data.

Click the Graphs option under Visuals (Figure 2-60).

Figure 2-60

OmniPeek can show a visual representation of traffic statistics.

Chapter

3

Investigating Web Attacks

Objectives After completing this chapter, you should be able to: • • • • • • • • • • • •

Recognize the indications of a Web attack Understand the different types of Web attacks Understand and use Web logs Investigate Web attacks Investigate FTP servers Investigate IIS logs Investigate Web attacks in Windows-based servers Recognize Web page defacement Investigate DNS poisoning Investigate static and dynamic IP addresses Protect against Web attacks Use tools for Web attack investigations

Key Terms an identifier string that indicates where a resource is located and the mechanism needed to retrieve it

Uniform Resource Locator (URL)

Introduction to Investigating Web Attacks This chapter will discuss the various types of attacks on Web servers and applications. It will cover how to recognize and investigate attacks, what tools attackers use, and how to proactively defend against attacks.

3-1

3-2

Chapter 3

Indications of a Web Attack There are different indications related to each type of attack, including the following: • Customers being unable to access any online services (possibly due to a denial-of-service attack) • Correct URLs redirecting to incorrect sites • Unusually slow network performance • Frequent rebooting of the server • Anomalies in log files • Error messages such as 500 errors, “internal server error,” and “problem processing your request”

Types of Web Attacks The different types of Web attacks covered in this chapter are the following: • Cross-site scripting (XSS) attack • Cross-site request forgery (CSRF) • SQL injection • Code injection • Command injection • Parameter tampering • Cookie poisoning • Buffer overflow • Cookie snooping • DMZ protocol attack • Zero-day attack • Authentication hijacking • Log tampering • Directory traversal • Cryptographic interception • URL interpretation • Impersonation attack

Cross-Site Scripting (XSS) Cross-site scripting (XSS) is an application-layer hacking method used for hacking Web applications. This type of attack occurs when a dynamic Web page gets malicious data from the attacker and executes it on the user’s system. Web sites that create dynamic pages do not have control over how their output is read by the client; thus, attackers can insert a malicious JavaScript, VBScript, ActiveX, HTML, or Flash applet into a vulnerable dynamic page. That page will then execute the script on the user’s machine and collect information about the user. XSS attacks can be either stored or reflected. Attacks in which the inserted code is stored permanently in a target server, database, message forum, and/or visitor log are known as stored attacks. In a reflected attack, the code reaches the victim in a different way, such as via an e-mail message. When a user submits a form or clicks on a link, that malicious code passes to the vulnerable Web server. The browser then executes that code because it believes that the code came from a trusted server. With this attack, attackers can collect personal information, steal cookies, redirect users to unexpected Web pages, or execute any malicious code on the user’s system.

Types of Web Attacks

3-3

Investigating Cross-Site Scripting (XSS) There is a chance that an XSS attacker may use HTML formatting tags such as for bold, for italic, and <script> when attacking a dynamic Web page. Rather than using text for those tags, the attacker may use the hex equivalent to hide the code. For instance, the hex equivalent of “<script>” is “%3C%73%63% 72%69%70%74%3E.” The following regular expression is a way to detect such types of attack: /((\%3C)|)/ix It checks the HTML opening and closing tags (“”) and the text between them so it can easily catch the , , and <script> contents. Table 3-1 shows how this expression works. An administrator can also use the following Snort signature to guard against this type of attack: alert tcp $EXTERNAL _ NET any -> $HTTP _ SERVERS $HTTP _ PORTS (msg:“NII Cross-site scripting attempt”; flow:to _ server,established; pcre:“/((\%3C)|)/i”; classtype:Web-application-attack; sid:9000; rev:5;) An XSS attack can also occur through the “

Searches for matches by the domain portion of an e-mail address

!

Searches for matches by handle or ID

.

Searches for matches by name

Display Flags ⴙ Shows detailed information for each match Shows a summary only, even if there is only a single match

WHOIS Example The following shows the results of a query for Google: Domain Name: GOOGLE.COM Registrar: ALLDOMAINS.COM INC. Whois Server: whois.alldomains.com Referral URL: http://www.alldomains.com Name Server: NS2.GOOGLE.COM Name Server: NS1.GOOGLE.COM Name Server: NS3.GOOGLE.COM

Steps for Investigating Internet Crime

6-11

Name Server: NS4.GOOGLE.COM Status: REGISTRAR-LOCK Updated Date: 03-oct-2002 Creation Date: 15-sep-1997 Expiration Date: 14-sep-2011 The following shows the results of querying WHOIS for registrar ALLDOMAINS.COM INC: Registrar Name: ALLDOMAINS.COM INC. Address: 2261 Morello Ave, Suite C, Pleasant Hill, CA 94523, US Phone Number: 925-685-9600 Email: [email protected] Whois Server: whois.alldomains.com Referral URL: www.alldomains.com Admin Contact: Chris J. Bura Phone Number: 925-685-9600 Email: [email protected] Admin Contact: Scott Messing Phone Number: 925-685-9600 Email: [email protected] Billing Contact: Chris J. Bura Phone Number: 925-685-9600 Email: [email protected] Billing Contact: Joe Nikolaou Phone Number: 925-685-9600 Email: [email protected] Technical Contact: Eric Lofaso Phone Number: 925-685-9600 Email: [email protected] Technical Contact: Chris Sessions Phone Number: 925-685-9600 Email: [email protected] Technical Contact: Justin Siu Phone Number: 925-685-9600 Email: [email protected] The following shows the results of querying WHOIS for name server NS2.GOOGLE.COM: Server Name: NS2.GOOGLE.COM IP Address: 216.239.34.10 Registrar: ALLDOMAINS.COM INC. Whois Server: whois.alldomains.com Referral URL: http://www.alldomains.com As shown in the example, a normal query will give a user a lot of information, including contact information, name of ISP, and name servers, which can be resolved further into specific IP addresses.

6-12

Chapter 6

Source: http://www.samspade.org. Accessed 2/2007.

Figure 6-4 Samspade is a Web-based utility that shows the WHOIS information for a given host.

Tool: Samspade Samspade is a Web-based WHOIS query tool. Figure 6-4 shows a screenshot of the results of a Samspade query.

Tool: IP Address Locator IP Address Locator allows a user to locate the geographical location of an IP address, as shown in Figure 6-5.

Tool: CentralOps.net CentralOps.net is a Web-based collection of Internet utilities. The following are some of the tools included in the suite: • Domain Dossier: Used to investigate domains and IP addresses • Domain Check: Sees if a domain is available • Email Dossier: Validates and investigates e-mail addresses • Browser Mirror: Shows what a user’s browser reveals • Ping: Sees if a host is reachable • Traceroute: Traces the path from one server to another • NsLookup: Looks up domain resource records

Steps for Investigating Internet Crime

6-13

Figure 6-5 IP Address Locator displays geographical information about an IP address.

Figure 6-6 CentralOps.net contains a variety of tools that provide Internet information.

• AutoWhois: Gets WHOIS records for domains worldwide • TcpQuery: Grabs Web pages, looks up domains, and more • AnalyzePath: Does a simple, graphical Traceroute Figure 6-6 shows a screenshot from CentralOps.net.

Tool: Traceroute The Traceroute utility displays the path IP packets travel between two systems. It can trace the number of routers the packets travel through, calculate the round-trip transit time between two routers and, if the routers have DNS entries, display the names of the routers and their network affiliation and geographic location. Traceroute

6-14

Chapter 6

works by exploiting an IP feature called time to live (TTL). The TTL field indicates the maximum number of routers a packet may transit. Each router that handles a packet will decrement the TTL count field in the ICMP header by one. When the count reaches zero, the packet will be discarded and an error message will be transmitted to the originator of the packet. Traceroute sends out a packet destined for a user-specified destination. It sets the TTL field in the packet to one. The first router in the path receives the packet, decrements the TTL value by one, discards the packet, and sends a message back to the originating host to inform it that the packet has been discarded. Traceroute records the IP address and DNS name of that router, and sends out another packet with a TTL value of two. This packet makes it through the first router and then times out at the next router in the path. This second router also sends an error message back to the originating host. Traceroute continues to do this, recording the IP address and name of each router until a packet finally reaches the target host or until it decides that the host is unreachable. A host may be unreachable for many reasons, including the presence of a packet-filtering device such as a firewall. In the process, Traceroute records the round-trip transit time for each packet. The following example shows the results of running the tracert 216.239.36.10 command at the Windows command prompt: Tracing route to ns3.google.com [216.239.36.10] over a maximum of 30 hops: 1

1262 ms

186 ms

124 ms

195.229.252.10

2

2796 ms

3061 ms

3436 ms

195.229.252.130

3

155 ms

217 ms

155 ms

195.229.252.114

4

2171 ms

1405 ms

1530 ms

5

2685 ms

1280 ms

655 ms

dxb-emix-ra.ge6303.emix.ae [195.229.31.99]

6

202 ms

530 ms

999 ms

dxb-emix-rb.so100.emix.ae [195.229.0.230]

7

609 ms

1124 ms

1748 ms

iar1-so-3-2-0.Thamesside.cw.net [166.63.214.65]

8

1622 ms

2377 ms

2061 ms

eqixva-google-gige.google.com [206.223.115.21]

9

2498 ms

968 ms

593 ms

10

3546 ms

3686 ms

3030 ms

216.239.48.89

11

1806 ms

1529 ms

812 ms

216.33.98.154

12

1108 ms

1683 ms

2062 ms

194.170.2.57

216.239.48.193

ns3.google.com [216.239.36.10]

Trace complete. Figure 6-7 shows a screenshot from Traceroute.

Figure 6-7

Traceroute shows the route that packets travel over a network.

Steps for Investigating Internet Crime

6-15

Collect the Evidence The investigator can gather the evidence using the following resources: • Volatile and other important sources of evidence on live systems: • Running processes (ps or the proc file system) • Active network connections (netstat) • ARP cache (arp) • List of open files (lsof) • Virtual and physical memory (/dev/mem, /dev/kmem) • Computer forensic tools for data collection, including: • Guidance Software’s EnCase (www.guidancesoftware.com) • AccessData’s Forensic Toolkit (www.accessdata.com)

Examining Information in Cookies Web sites use cookies to authenticate, track, and maintain specific information about users. The following is the syntax of a Set-Cookie header: Set-Cookie: ⫽; expires⫽<TIMESTAMP>; path⫽; domain⫽; • Name: Identifies cookie • Content: Contains a string of information that has some specific meaning to the server; the content is often encoded in some way • Timestamp: Denotes the date, time, and duration of a cookie • Path: Denotes the directory on the target site • Domain: Defines hosts within a domain that the cookie applies to

Viewing Cookies in Firefox The following are the steps for viewing cookies in Firefox: 1. Go to Tools and then Options (Figure 6-8). 2. Click on Show Cookies (Figure 6-9).

Tool: Cookie Viewer Cookie Viewer scans a system, looking for the cookies created by Internet Explorer, Netscape Navigator, and Firefox. It displays the data stored in each cookie. It can also delete any unwanted cookies stored by these browsers. Figure 6-10 shows a screenshot from Cookie Viewer.

URL Redirection URL redirection is a technique where many URLs point to a single Web page. It is done by posting the address of one site and redirecting the traffic it receives to a target address. It can be done in two basic ways: 1. Page-based redirection: In this method, the administrator inserts a special tag in a Web page on the proxy site that tells the browser to go to the target. The administrator first creates a Web page and then inserts a META tag into the HEAD section of the proxy site’s main page. The following is an example of this page: • <meta http-equiv⫽“refresh” content⫽“0; URL⫽http://www.craic.com”> 2. Server-based redirection: In this method, the administrator adds a line to the Web server configuration file to intercept the request for a specific page and tell the browser to fetch it from the target location. The following are some of the ways an administrator can accomplish this: • Adding a one-line Redirect directive to the file and restarting the server; the following is the syntax of this directive: Redirect

6-16

Chapter 6

Figure 6-8 The Options window in Firefox allows a user to look at cookies.

Figure 6-9

Firefox organizes cookies by the site they come from.

Steps for Investigating Internet Crime

6-17

Source: http.//www.karenware.com/powertools/ptcookie.asp. Accessed 2/2007.

Figure 6-10

Cookie Viewer allows a viewer to see the contents of a cookie.

• Creating a Web page from a server-side script (generally in Perl or PHP) and including a Location header. This method is widely used by phishing Web sites. The following is an example of this header: Location: http://www.google.com

Sample JavaScript for Page-Based Redirection var version ⫽ navigator.appVersion; // sets variable ⫽ browser version if (version.indexOf(“MSIE”) >⫽ -1) // checks to see if using IE { window.location.href⫽“ie.htm” /* If using IE, it shows this page replace ie.htm with page name */ } else window.open(“other.htm”, target⫽“ _ self”) /* else open other page replace other.html with page name */

Embedded JavaScript JavaScript is an object-oriented dynamic scripting language. It is used in millions of Web pages and server applications to perform specific tasks such as opening pop-up windows or submitting form information.

6-18

Chapter 6

A developer can insert JavaScript into a Web page using the following syntax: <SCRIPT LANGUAGE⫽“JavaScript”> The following are some of the ways attackers use embedded JavaScript: • Hide source HTML for a page: The escape command hides HTML and/or JavaScript from other people. The following is an example: <script language⫽“javascript”> document.write( escape( ‘HTML file name’ ) ); • Manipulate the URL displayed in the status bar and browser history.

Downloading a Single Page or an Entire Web Site To save a page from Firefox, a user needs to choose File and then Save Page As, which brings up the window shown in Figure 6-11. The following tools are available for saving an entire Web site: • Grab-a-Site • SurfOffline • My Offline Browser

Tool: Grab-a-Site Grab-a-Site is a file-based offline browser that allows a user to grab complete sections of the World Wide Web. When a user grabs a site, it is downloaded onto the user’s hard drive. The user can tell Grab-a-Site specifically which sites to grab and which sites to exclude, using filters. The following are some of the features of Grab-a-Site: • Grabs every movie (MOV, AVI), picture (JPG), document (PDF), program (EXE), or archive (ZIP) file from a site

Figure 6-11 A user can save a Web page in Firefox using this Save As dialog.

Steps for Investigating Internet Crime

• • • •

6-19

Grabs from multiple Web sites at the same time Exports a Web site to burn it to a CD with Nero, Easy CD Creator, or some other CD-burning software Generates files so that CDs of Web sites will automatically run when inserted into a CD drive Stores files just like on a Web server, except the user will not need Web access to view the files

Figure 6-12 shows a screenshot from Grab-a-Site.

Tool: SurfOffline SurfOffline is an offline browser that is capable of downloading up to 100 files simultaneously. The software can save a partial or complete copy of a Web site to a user’s hard drive in just a few minutes. Another important feature is a wizardlike interface that enables users to quickly set up downloading rules. The program supports HTTP, SSL (HTTPS), FTP, proxy servers, CSS, Macromedia Flash, and JavaScript parsing. The following are some of the features of SurfOffline: • • • • •

Can download up to 100 files simultaneously Can download up to 200,000 files in one project Downloads entire Web sites (including images, video, audio) Prepares downloaded Web sites for writing to a CD or DVD Downloads password-protected Web pages and password-protected Web sites

Figure 6-13 shows a screenshot from SurfOffline.

Tool: My Offline Browser My Offline Browser is an offline browser that allows a user to automatically download and save entire Web sites, including all pages, images, Flash, and other files to the user’s hard disk. My Offline Browser changes all the links in the HTML code to relative local links, so a user can browse the downloaded Web sites offline using a regular Web browser or the built-in browser. My Offline Browser is a bot that downloads a page and then goes to all the links on that page. It continues following links on the linked pages until it runs out of links.

Source: http://www.bluesquirrel.com/products/grabasite/. Accessed 2/2007.

Figure 6-12 A user can limit how much data Grab-a-Site acquires from a site.

6-20

Chapter 6

Source: http://www.surfoffline.com/. Accessed 2/2007.

Figure 6-13 SurfOffline allows a user to view the Web pages that have been downloaded from a site.

Source: http://www.newprosoft.com/offline-browser.htm. Accessed 2/2007.

Figure 6-14 My Offline Browser allows users to view Web pages without an Internet connection.

The following are some of the features of My Offline Browser: • Supports multithreaded downloading (up to 50 threads) • Automatically reexecutes any task • Supports proxy servers • Limits downloading by URL filter, maximum crawling depth, and maximum file size • Exports all URLs into a text file or an Excel file Figure 6-14 shows a screenshot from My Offline Browser.

Steps for Investigating Internet Crime

6-21

Tool: Wayback Machine The Wayback Machine is a Web-based utility that allows users to browse through 85 billion Web pages archived from 1996 to just a few months ago. To view the history of a Web site, perform the following steps: 1. Go to www.archive.org. 2. Type in the Web address of a site or page. 3. Press Enter or click on Take Me Back. 4. Click on the desired date from the archive dates (Figure 6-15) available. The resulting pages point to other archived pages at as close a date as possible. The Wayback Machine offers many advanced search options, as shown in Figure 6-16.

Figure 6-15 The Wayback Machine displays a list of archived Web pages by date that a user can pick from.

Figure 6-16 The Wayback Machine provides a lot of different search options so users can find the exact archived Web pages they want.

6-22

Chapter 6

Figure 6-17 A user can view the source of a Web page using Firefox and a text editor.

Recovering Information from Web Pages To recover the source code of a Web page, an investigator can do one of the following, depending on the browser (other browsers may have slightly different ways of doing this): • Click View and select Source in Internet Explorer. • Click View and select Page Source in Firefox. Figure 6-17 shows the source of a page being viewed in Notepad.

Trace the E-Mail Addresses The investigator needs to trace the e-mail addresses to determine the source of any e-mails involved in the investigation. Investigators can use this technique to find the source of spam e-mails or phishing e-mails, among other things. The following are some of the tools available for tracing e-mail addresses: • Samspade (www.samspade.org) • VisualRoute (http://visualroute.visualware.com) • CentralOps.net (www.centralops.net) • Abika (www.abika.com)

Tool: VisualRoute VisualRoute is a graphical tool that determines where and how virtual traffic is flowing on the route between the desired destination and the location from which the user is trying to access it. It provides a geographical map of the route and performance information about each portion of that route. VisualRoute has the ability to identify the geographical location of routers, servers, and other IP devices. This is valuable information for identifying the source of network intrusions and Internet abusers. It helps in establishing the identity of the originating network, identifying the Web software that a server is running, detecting routing loops, and identifying hosts. VisualRoute provides WHOIS information about any host, including the site owner’s name, telephone number, and e-mail address, providing instant contact information for problem reporting. Figure 6-18 shows a screenshot from VisualRoute.

E-Mail Headers Headers give the following information about an e-mail: • Source • Destination • Subject of the e-mail

Steps for Investigating Internet Crime

6-23

• Date • Route Figure 6-19 shows part of an e-mail header.

E-Mail Header Forging The following are the steps to forge e-mail headers: 1.

Open a command prompt.

2.

Find out the name of the ISP’s mail server from the e-mail client settings (for example, mail.isp.com or smtp.isp.com).

3.

Connect to the ISP, and type SMTP commands after the mail server responds.

Source: http://www.visualware.com. Accessed 2/2007.

Figure 6-18 VisualRoute shows a graphical representation of the route a packet takes through the network.

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 6-19 the e-mail.

E-mail headers contain information that allows an investigator to trace the source of

6-24

Chapter 6

4.

Continue with the fake address the mail will say it comes from. For example, to forge mail from XYZ@ abc.com, type mail from: [email protected].

5.

Specify the recipient of the e-mail. For example, to send mail to your enemy, type rcpt to: yourenemy@ isp.com.

6.

Type data and press Enter.

7.

On the first line, type the subject (for example, subject: your subject) and press Enter twice.

8.

Type the content of the message.

9.

Type a period (.) and press Enter.

The server should respond, “Message accepted for delivery.” Figure 6-20 shows a transcript of a telnet session where a user is forging e-mail headers.

HTTP Headers The following are some of the different types of HTTP headers: • Entity: Meta information about an entity body or resource • General: Applicable for use both in request and in response messages • Request: Sent by a browser or other client to a server • Response: Sent by a server in response to a request The following are some of the types of information headers include: • Accept: Specifies which Internet media types are acceptable for the response and assigns preferences to them • Accept-Charset [Request]: Specifies which character encodings are acceptable for the response and assigns preferences to them • Accept-Encoding [Request]: Specifies the data format transformations, called content encodings • Accept-Ranges [Response]: Indicates the server’s acceptance of range requests for a resource • Age [Response]: Gives the sender’s estimate of the amount of time since the response (or its revalidation) was generated at the origin server • Allow [Entity]: Lists the set of methods supported by the resource identified by the Request-URI

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 6-20 A user can forge e-mail headers by connecting directly to the mail server and issuing SMTP commands.

Steps for Investigating Internet Crime

6-25

Figure 6-21 A user can view HTTP header information by looking at the Page Info window in Firefox.

• Authorization [Request]: Consists of credentials containing the authentication information of the client for the realm of the resource being requested • Cache-Control [General]: Specifies directives that must be obeyed by all caching mechanisms along the request/response chain • Connection [General]: Specifies options that are desired for the particular connection and must not be communicated by proxies over further connections • Content-Encoding [Entity]: Used as a modifier to the media type • Content-Language [Entity]: Specifies the natural language(s) of the intended audience for the enclosed entity • Content-Length [Entity]: Indicates the size of the entity body that is sent or that would have been sent if it had been requested

Viewing Header Information In Mozilla Firefox, an investigator can view header information by going to Tools and selecting Page Info (Figure 6-21).

Tool: NeoTrace (now McAfee Visual Trace) NeoTrace is a diagnostic and investigative tool that traces the network path across the Internet from the host system to a target system. Automatic retrieval of data includes registration details for the owner of each computer on the route (address, phone number, and e-mail address) and the network to which each node IP is registered. Views of the data include a world map showing the locations of nodes along the route, a graph showing the relative response time of each node along the path, and a configurable list of node data. Figure 6-22 shows a screenshot from NeoTrace.

6-26

Chapter 6

Figure 6-22

NeoTrace shows the path of a packet using geographic visuals.

Tool: NetScan Tools NetScan Tools is an advanced Internet information-gathering program for Windows. An investigator can use it to research IP addresses, host names, domain names, e-mail addresses, and URLs automatically or with manual tools. The following are some of the benefits of NetScan Tools: • Requires less time to gather information about Internet or local LAN users, network devices, IP addresses, ports, and many other network specifics • Removes guesswork from Internet investigation by automating research requiring multiple network tools • Produces clear, concise result reports in HTML or CSV format Figure 6-23 shows a screenshot from NetScan Tools.

Generate a Report The generated report must at least contain the following information: • Name of the investigator • List of router evidence • Documents of the evidence and other supporting items • List of tools used for investigation • List of devices and setups used in the examination

Chapter Summary

6-27

Source: http://www.netscantools.com/. Accessed 2/2007.

Figure 6-23 The different tabs in NetScan Tools represent different Internet utilities that a user can utilize to find information.

• Brief description of the examination steps • Details about the findings: • Information about the files • Internet-related evidences • Data and image analysis • Conclusion of the investigation

Chapter Summary ■

Internet crimes are crimes committed over the Internet or by using the Internet.

■

Internet forensics is the application of scientific and legally sound methods for the investigation of Internet crimes.

■

URL redirection is a technique where many URLs point to a single Web page.

■

Attackers use embedded JavaScript to cover their tracks.

■

Cookies are used for authenticating, tracking, and maintaining specific information about users.

■

Nslookup is a process that converts a unique IP address into a domain name and is frequently used by Webmasters to research listings contained in server log files.

6-28

Chapter 6

Review Questions 1. What is the purpose of IANA? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 2. What is an RIR? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 3. What is URL redirection? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 4. Describe the different types of DNS queries a user can make. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 5. Describe the steps involved in forging e-mail headers. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 6. What is embedded JavaScript, and how do attackers use it? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 7. Describe the different classes of IP addresses. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 8. What is the purpose of DNS? ___________________________________________________________________________________________ ___________________________________________________________________________________________

Hands-On Projects 1. Visit the U.S. Department of Justice Web site (www.usdoj.gov) and read about laws concerning Internet crimes. 2. Visit the National Conference for State Legislatures’ Web site and read about laws concerning Internet crimes at www.ncsl.org/programs/lis/cip/ciphome.htm. 3. Perform the following steps: ■

Navigate to Chapter 6 of the Student Resource Center.

■

Install and launch the Grab-a-Site program.

■

Pick a site to grab and download that site. Use various combinations of filters to see the effects.

Chapter

7

Tracking E-Mails and Investigating E-Mail Crime

Objectives After completing this chapter, you should be able to: • • • • • • • • • • •

Understand e-mail systems Understand e-mail clients Understand e-mail servers Understand e-mail crime Understand spamming Understand identity theft and chain e-mails Investigate e-mail crimes and violations Enumerate common e-mail headers Understand Microsoft Outlook Trace an e-mail message Understand U.S. laws against e-mail crime

Key Terms the willful act of stealing someone’s identity for monetary benefits Internet Message Access Protocol (IMAP) an Internet protocol designed for accessing e-mail on a mail server Mail bombing the intentional act of sending multiple copies of identical content to the same recipient in order to hinder the functions of the recipient’s mail server Mail storm a large flurry of e-mail sent through automated processes, often without malicious intent Mail user agent (MUA) a computer application used to manage e-mail; also called an e-mail client Post Office Protocol version 3 (POP3) an Internet protocol used to retrieve e-mail from a mail server Identity theft

7-1

7-2

Chapter 7

an Internet protocol for transmitting e-mail over IP networks unsolicited commercial e-mail that is sent to a large number of e-mail addresses at the same time

Simple Mail Transfer Protocol (SMTP) Spam

Introduction to Tracking E-Mails and Investigating E-Mail Crime The focus of this chapter is on how to investigate e-mail crimes and what countermeasures a user can take to prevent them. The chapter covers the different parts of an e-mail system before diving into a discussion of the different kinds of e-mail crimes. The chapter also discusses the U.S. laws concerning e-mail crime.

E-Mail Systems E-mail is a term derived from the phrase electronic mail. Users can send and receive messages over an electronic communication system, such as the Internet. An e-mail system consists of both the servers that send and receive e-mails on the network and the e-mail clients that allow users to view and compose messages. Figure 7-1 is a simple depiction of an e-mail system. An e-mail system works in the following way: 1. A user—let’s call her Jane—composes a message using her mail user agent (MUA) and writes the e-mail address of her correspondent—Peter, in this example—and hits the Send button. 2. Jane’s MUA formats the message in the Internet e-mail format and uses SMTP to send the message to the local mail transfer agent (MTA). 3. The MTA looks at the destination address provided in SMTP. 4. The MTA looks for this domain name in the Domain Name System to find the mail exchange servers accepting messages for Peter’s domain. 5. The DNS server responds with a mail exchange record for Peter’s domain. 6. Jane’s SMTP server sends the message to the mail exchange server of Peter’s domain. 7. Peter presses the Get Mail button in his MUA, which picks up the message using the Post Office Protocol (POP3). Peter then reads the message in his MUA.

E-Mail Client An e-mail client, also known as a mail user agent (MUA), is a computer program for reading and sending e-mail. There are a number of standalone e-mail clients, including the following: • Microsoft Outlook • Microsoft Outlook Express • Eudora • Pegasus

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 7-1 An e-mail system is made up of mail servers and the clients that connect to them.

E-Mail Systems

7-3

• The Bat! • Mozilla Thunderbird There are also a number of Web-based e-mail clients, including the following: • Hotmail • Yahoo! • Gmail E-mail clients perform the following common functions: • They display all the messages in a user’s inbox. The message header typically shows the date, time, subject of the mail, who sent the mail, and the mail’s size. • A user can select a message and read the data in the message. • A user can create e-mails and send them to others. • A user can add a file attachment to a message and can also save any attachments received in other messages.

E-Mail Server An e-mail server connects to and serves several e-mail clients. An e-mail server works in the following way: • An e-mail server has a number of e-mail accounts; each person typically has one account. • The server contains a text file for each account. This text file contains all the messages for that account. • When a user presses the Send button in his or her e-mail client, the client connects to the e-mail server and passes the message and its accompanying information (including the sender and receiver) to the server. • The server formats that information and attaches it to the bottom of the receiving user’s file. The server also saves the time, date of receipt, and subject line into the file. • If the receiving user wants to see the message in an e-mail client, then he or she has to send a request to the server via the e-mail client.

SMTP Server Simple Mail Transfer Protocol (SMTP) is an Internet protocol for transmitting e-mail over IP networks. An SMTP server listens on port 25 and handles all outgoing e-mail. When a user sends an e-mail, the SMTP server from that user’s host interacts with the receiving host’s SMTP server. Consider an example where a user has an account with myicc.com, and he or she wants to send a mail to [email protected] through a client such as Outlook Express. The procedure works as follows: • When the user clicks on the Send button, Outlook Express connects to the server of myicc.com at port 25. • This client tells the SMTP server about the sender’s address, recipient’s address, and body of the message. • The SMTP server breaks the recipient’s address into the following parts: • The recipient’s name (john) • The domain name (mybird.com) • This SMTP server contacts the DNS (Domain Name Service) server and asks about the IP address of the SMTP server for mybird.com. • The SMTP server from myicc.com connects to the SMTP server for mybird.com using port 25 and sends the message to it. The SMTP server at mybird.com gets the message and transfers it to the POP3 server.

POP3 Servers Post Office Protocol version 3 (POP3) is an Internet protocol used to retrieve e-mail from a mail server. A POP3 server handles incoming mails. The server contains one text file for each e-mail account. The POP3 server acts as an intermediary between the e-mail client and this text file. When a message comes in, the POP3 server attaches that message to the bottom of the recipient’s file. POP3 servers require usernames and passwords. An e-mail client connects with a POP3 server via port 110. The server opens the text file and permits the user to

7-4

Chapter 7

access it. It then deletes the messages from the server. A POP3 server can understand simple commands such as the following: • USER: accept a user ID • PASS: accept a password • QUIT: quit the POP3 server • LIST: list the messages and their sizes • RETR: retrieve a message • DELE: delete a message

IMAP Servers Internet Message Access Protocol (IMAP) is an Internet protocol designed for accessing e-mail on a mail server. IMAP servers are similar to POP3 servers. Like POP3, IMAP handles incoming mails. An e-mail client connects to an IMAP server via port 143. Unlike POP3, this protocol keeps e-mails on the server after a user has downloaded them. A user can also arrange e-mails into folders and store the folders on the server.

Importance of Electronic Records Management

Electronic records management is the field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of electronic records, including the processes for capturing and maintaining evidence of and information for legal, fiscal, administrative, and other business purposes. The importance of electronic records management is as follows: • It helps in the investigation and prosecution of e-mail crimes. • It acts as a deterrent for abusive and indecent materials in e-mail messages. • It helps in nonrepudiation of electronic communication so that someone cannot deny being the source of a particular communication.

E-Mail Crime E-mail crime is a serious offense. Over the past few years, e-mail has become the most preferred method of communication because of its ease of use and speed. But these advantages have made e-mail a powerful tool for criminals. E-mail crimes and violations are identified by the cyber laws created by the government of the place from where the e-mail originates. For example, spamming is a crime in Washington State, but not in other states. E-mail crime can be categorized in two ways: crimes committed by sending e-mails and crimes supported by e-mails. The following are examples of crimes committed by sending e-mails: • Spamming • Fake e-mails • Mail bombing • Mail storms The following are examples of crimes supported by e-mail: • Selling narcotics • Stalking

E-Mail Crime

7-5

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 7-2

Spam mail often has a misleading subject line.

• Fraud • Child pornography • Child abduction

Spamming Unsolicited commercial e-mail (UCE), or junk e-mail, can be defined as spam. Spam mail involves sending the same content to a large number of addresses at the same time. Spammers often obtain these addresses from Usenet postings, DNS listings, and Web pages. Spam mail fills mailboxes and often prevents users from accessing their regular e-mails. These regular e-mails start bouncing because the user exceeds his or her mail server quota. Spammers hide their identities by forging e-mail headers. To avoid getting annoyed responses, spammers provide misleading information in the “From” and “Reply-To” fields. Figure 7-2 shows a list of spam e-mails.

Handling Spam When a user receives spam, he or she can send a short notice to the domain administrator of the sender’s ISP to take immediate action and stop the nuisance. The user can also send a copy of the spam to the ISP. If the spamming persists, the user can report it to the Federal Trade Commission (FTC). The user can send a copy of the spam message to [email protected]. The FTC refers the spam mails stored in its database to law enforcement to pursue action against spammers. The FTC’s online complaint form is available at www.ftc.gov. Any complaint should include the e-mail header. The header information is important for consumer protection agencies to follow up on spam complaints.

Network Abuse Clearinghouse at Abuse.Net The Network Abuse Clearinghouse is a mail-forwarding service that forwards abuse complaints to the system administrator for action. It is not a blacklist or spam analysis service. A domain name listed in abuse.net does not mean that the domain is involved in abusive activity. The Network Abuse Clearinghouse contact database has contact addresses for more than 200,000 domains. Responsible providers and domain managers submitted the domain contacts voluntarily, and abuse.net forwards messages to the listed addresses. A user can utilize e-mail forwarding only if he or she has registered with the service. To register, a user sends a mail to [email protected] and accepts the terms and conditions. After registration, mail can be sent to [email protected], where domain-name is the name of the source responsible for the abuse. The Network Abuse Clearinghouse automatically e-mails the message back to the best reporting addresses for that domain, and proper action can then be taken against the abusive domain.

Tool: SPAM Punisher This antispam tool makes the search for a spammer’s ISP address easy. It automatically detects forged addresses. SPAM Punisher supports various e-mail client programs such as Microsoft Outlook, AOL,

7-6

Chapter 7

Figure 7-3 SPAM Punisher can generate an e-mail complaint about spam and send it to a spammer’s ISP.

Hotmail, and Eudora. SPAM Punisher generates and sends complaints to the ISP regarding spamming, as shown in Figure 7-3.

Tool: Spam Arrest Spam Arrest protects accounts against spam. It uses challenge/response antispam technology. It allows a user to access his or her e-mail from any Web browser, without having to install any additional software. Spam Arrest works with a user’s existing e-mail address, including AOL, Hotmail, and Yahoo!. A user can also use Spam Arrest with Eudora, Thunderbird, and other standalone e-mail clients. The following are some of the features of Spam Arrest: • Supports POP3/IMAP • Supports SMTP with autoauthorization • Provides 1 GB of e-mail storage • Provides multiple whitelist options, including authorizing incoming messages based on sender e-mail, sender domain, recipient e-mail, mailing list e-mail, and more • Allows a user to create an unlimited number of disposable addresses to help control and categorize e-mail • Provides antivirus protection • Provides antiphishing protection • Allows a user to forward his or her Spam Arrest inbox to another e-mail account or wireless device • Provides e-mail delivery confirmation Figure 7-4 shows a screenshot from Spam Arrest.

Mail Bombing Mail bombing is the intentional act of sending multiple copies of identical content to the same recipient. The primary objective behind mail bombing is to overload the e-mail server and degrade the communication system by making it unserviceable. Usually, a mail bomber and the victim are known to each other in some way. Mail

E-Mail Crime

7-7

Figure 7-4 Users can look through a Spam Arrest inbox to verify whether an e-mail is spam or legitimate.

bombers also attack users whose newsgroup and forum postings do not agree with the mail bomber’s opinions. The target for a mail bomber can be either a specific machine or a particular person. Mail bombing is more abusive than spamming because it not only sends mails in excessive amounts to a particular person, but it also prevents other users using the same server from accessing their e-mails.

Mail Storm A mail storm occurs when computers start communicating without human intervention. The flurry of junk mail, often sent by accident, is a mail storm. Usage of mailing lists, autoforwarding e-mails, automated response, and the presence of more than one e-mail address are the various causes for a mail storm. Malicious software code, such as the “Melissa, I-Love-u” message, is also written to create mail storms. Mail storms hinder communication systems and also make them inoperable.

Crime via Chat Rooms

A chat room is a Web site or part of a Web site where a number of users, often with common interests, can communicate in real time. Online instant messaging and chat rooms have benefited children, but they are also potential sources of sexual abuse. Pedophiles use chat rooms to sexually abuse children by establishing online relationships with them. After establishing a steady relationship, they introduce children to pornography by providing images and videos that have sexually explicit material. Pedophiles exploit children for cybersex, which may lead to physical abuse.

7-8

Chapter 7

Identity Theft Identity theft is the willful act of stealing someone’s identity for monetary benefits. Criminals obtain personal information about a person and misuse it, causing heavy financial loss to the victim. False shopping sites and spam mails that contain irresistible offers are common means used to obtain a victim’s credit card numbers. Criminals not only withdraw huge amounts from the victim’s bank accounts but can also make the victim bankrupt.

Chain E-Mails A chain e-mail is a message that is sent successively to several e-mail users. It directs the recipients to circulate multiple copies of the e-mail, often promising rewards for this compliance, such as a blessing or good luck. A chain e-mail can be in the form of sympathy or threats.

Phishing Phishing has emerged as an effective method to steal the personal and confidential data of users. It is an Internet scam that tricks users into divulging their personal and confidential information by making false statements and enticing offers. Phishers can attack users through mass mailings to millions of e-mail addresses around the world. A successful phishing attack deceives and convinces users with fake technical content and social engineering practices. The major task for phishers is to make the victims believe in the phishing sites. Most phishing attacks are initiated through e-mails, where the user gets an e-mail that prompts him or her to follow a link given in the e-mail. This link leads to a phishing Web site, though the e-mail says otherwise. The e-mail may contain a message stating that a particular transaction has taken place on the user’s account, and a link is provided to check his or her balance. Or the e-mail may contain a link to perform a security check on the user’s account.

E-Mail Spoofing E-mail spoofing is the process of altering e-mail headers so that an e-mail appears to be from someone or somewhere other than the original source. Spammers and phishers use this technique to conceal the origin of their email messages. The following are the e-mail header fields that are most often changed during e-mail spoofing: • From • Return-Path • Reply-To

Investigating E-Mail Crimes and Violations The steps involved in investigating e-mail crimes and violations are as follows: 1. Examine an e-mail message. 2. Copy the e-mail message. 3. Print the e-mail message. 4. View the e-mail headers. 5. Examine any attachments. 6. Trace the e-mail.

Obtaining a Search Warrant and Seizing the Computer and E-Mail Account A search warrant application should include the proper language to perform on-site examination of the suspect’s computer and the e-mail server used to send the e-mails under investigation. The investigator should seize all

Investigating E-Mail Crimes and Violations

7-9

computers and e-mail accounts suspected to be involved in the crime. Investigators can seize e-mail accounts by just changing the existing password of the e-mail account either by asking the suspect his or her password or from the mail server.

Examining E-Mail Messages After it is established that an e-mail crime has been committed, investigators require evidence to prove the crime. To obtain evidence, investigators need access to the victim’s computer so they can examine the e-mail that the victim received. As with all forensic investigations, analysis should not be done on the original data. The investigator should image the victim’s computer first. Then, the investigator should physically access the victim’s computer and use the same e-mail program the victim used to read the e-mail. If required, the investigator can get the username and password from the victim and log on to the e-mail server. If physical access to a victim’s computer is not feasible, the investigator should instruct the victim to open and print a copy of an offending message, including the header. The header of the e-mail message has a key role to play in e-mail tracing because it contains the unique IP address of the server that sent the message.

Copying an E-Mail Message An e-mail investigation can be started as soon as the offending e-mail message is copied and printed. Any e-mail client will allow an investigator to copy e-mail messages from the inbox folder to a floppy disk. The following are the steps to copy an e-mail message using Microsoft Outlook or Outlook Express: 1. Insert a formatted floppy disk into the floppy disk drive. 2. Navigate to My Computer or Windows Explorer to view the floppy disk. 3. Start Microsoft Outlook or Outlook Express. 4. Click the folder that contains the offending message, keeping the Folders list open. 5. Resize the Outlook window to see both the message to be copied and the floppy disk contents. 6. Drag the message from the Outlook window to the floppy disk. E-mail programs, such as Pine, that run from the command line have a command to copy an e-mail message.

Printing an E-Mail Message The next step after copying the e-mail message is to print it. The following steps provide guidelines for printing an e-mail message in Outlook Express: 1. Go to My Computer or Windows Explorer and get the copy of the e-mail message received by the victim. 2. Open the message in the e-mail program. 3. Go to the File menu and click Print. 4. After selecting the settings for printing in the dialog box, click the Print button. For command line e-mail clients, an investigator can open the e-mail message and select the print option.

Obtaining a Bit-By-Bit Image of E-Mail Information Investigators should make a bit-by-bit image of all the folders, settings, and configuration for the e-mail account for further investigation. They should then use MD5 hashing on the image to maintain integrity of the evidence.

Viewing and Copying E-Mail Headers in Microsoft Outlook The procedure to view and copy headers in Microsoft Outlook is as follows: 1. Launch Outlook and open the copied e-mail message. 2. Right-click on the message and click on Options. 3. Right-click in the Internet Headers box and choose Select All. 4. Copy the header text and paste it into any text editor. 5. Save the text file.

7-10

Chapter 7

Figure 7-5

This window shows the headers for an AOL e-mail.

Viewing and Copying E-Mail Headers in AOL The procedure to view and copy headers in AOL is as follows: 1. Launch the program. 2. Open the received message. 3. Click the DETAILS link. This brings up the window in Figure 7-5. 4. Select the header text and copy it. 5. Paste the text into any text editor and save the file.

Viewing and Copying E-Mail Headers in Hotmail The procedure to view and copy headers in Hotmail is as follows: 1. Logon to Hotmail. 2. Right-click on the received message. 3. Click View message source. 4. Select the header text and copy it. 5. Paste the text into any text editor (Figure 7-6) and save the file.

Viewing and Copying E-Mail Headers in Gmail The procedure to view and copy headers in Gmail is as follows: 1. Logon to Gmail. 2. Open the received mail.

Investigating E-Mail Crimes and Violations

Figure 7-6

7-11

An investigator can copy Hotmail e-mail headers to a text file.

Figure 7-7

Showing the original e-mail in Gmail displays the headers.

3. Click on the More option. 4. Click on Show original (Figure 7-7). 5. Select the header text and copy it. 6. Paste the text into any text editor and save the file.

Viewing and Copying E-Mail Headers in Yahoo! Mail The procedure to view and copy headers in Yahoo! Mail is as follows: 1. Logon to Yahoo! Mail. 2. Open the received mail. 3. Click on Full Header. 4. Select the header text and copy it (Figure 7-8). 5. Paste the text into any text editor and save the file.

Examining an E-Mail Header An investigator can acquire the IP address of the sender of an e-mail by examining the e-mail header. The e-mail header also provides additional information like the date and time the message was sent and any attachments included with the message.

7-12

Chapter 7

Figure 7-8

Copying the headers from Yahoo! Mail is a simple task.

Mail originated from this IP address

Figure 7-9

Line 7 shows the address of the originating e-mail server.

The message header can provide significant information if examined properly. Figure 7-9 shows a sample message header with added line numbers to explain the different parts of the header. This header was generated by qmail, a UNIX mail system. Information about the e-mail’s origin is contained in lines 1, 3, 4, and 5. The return path for sending a reply is indicated in line 1. The return path information is not reliable because it can be faked easily. The recipient’s e-mail address is specified in line 2. The e-mail service provider can verify the e-mail address. An investigator can authenticate the victim’s address by cross-checking it with the bill or log provided by the service provider. Line 3 displays a header identifying it as a qmail header followed by an identifier. Line 4 indicates the IP address of the e-mail server that was used to send the offending message. Line 5 contains the name and IP address of the e-mail server exploited to connect to the victim’s e-mail server. The piece of information crucial for tracing the origin of the e-mail origin is contained in lines 6 and 7. Line 6 illustrates a unique message ID that is assigned by the sending server. Line 7 shows the IP address of the e-mail server along with the date and time. Line 7 also specifies the protocol used to send the e-mail.

Investigating E-Mail Crimes and Violations

7-13

If a message has an attachment, the name of the attachment is shown in the header itself. Attachments serve as supporting evidence in an investigation. An investigator should search for the attachment on the victim’s hard drive. After retrieving the file, the investigator can copy it to preserve the evidence.

“Received” Headers “Received” headers provide a detailed log of a message’s history, and they make it possible to draw some conclusions about the origin of an e-mail, even when other headers have been forged. If, for instance, the machine turmeric.com, whose IP address is 104.128.23.115, sends a message to mail. bieberdorf.edu, but falsely says HELO galangal.org, the resultant “Received” line might start like this: Received: from galangal.org ([104.128.23.115]) by mail.bieberdorf.edu (8.8.5)...

Forging “Received” Headers A common trick e-mail forgers use is to add spurious “Received” headers before sending the offending mail. This means that the hypothetical e-mail sent from turmeric.com might have “Received” lines that look something like this: Received: from galangal.org ([104.128.23.115]) by mail.bieberdorf.edu (8.8.5)... Received: from nowhere by outer space (8.8.3/8.7.2)... Received: This is a header. Move along. The last two lines are complete nonsense, written by the sender and attached to the message before it was sent. Since the sender has no control over the message once it leaves turmeric.com, and “Received” headers are always added at the top, the forged lines have to appear at the bottom of the list. This means that someone reading the lines from top to bottom, tracing the history of the message, can safely throw out anything after the first forged line; even if the “Received” lines after that point look plausible, they are guaranteed to be forgeries.

Common Headers The following is a list of some common headers: • Content-Transfer-Encoding: This header relates to MIME, a standard way of enclosing nontext content in e-mail. It has no direct relevance to the delivery of mail, but it affects how MIME-compliant mail programs interpret the content of the message. • Content-Type: This is another MIME header, telling MIME-compliant mail programs what type of content to expect in the message. • Date: This header specifies a date, normally the date the message was composed and sent. If the sender’s computer omits this header, it might conceivably be added by a mail server or even by some other machine along the route. • Errors-To: This header specifies an address for mailer-generated errors, such as bounce messages, to go to (instead of the sender’s address). This is not a particularly common header, as the sender usually wants to receive any errors at the sending address, which is what most mail server software does by default. • From: This is whom the message is from. • Apparently-to: Messages with many recipients sometimes have a long list of headers of the form “Apparently-to: [email protected]” in them. These headers are unusual in legitimate mail; they are normally a sign of a mailing list, and in recent times mailing lists have generally used software sophisticated enough not to generate a giant pile of headers. • Bcc: This stands for “blind carbon copy.” If this header appears in incoming mail, something is wrong. This header is used to send copies of e-mails to people who might not want to receive replies or to appear in the headers. Blind carbon copies are popular with spammers, since they confuse many inexperienced users who get e-mail that does not appear to be addressed to them. • Cc: This stands for “carbon copy.” This header specifies additional recipients beyond those listed in a “To” header. The difference between “To” and “Cc” is essentially connotative; some mailers also deal with them differently in generating replies. • Comments: This is a nonstandard, free-form header field. Some mailers add this header to identify the sender; however, spammers often add it by hand (with false information).

7-14

Chapter 7

• Message-Id: This header specifies a more-or-less unique identifier assigned to each message, usually by the first mail server it encounters. Conventionally, it is of the form “[email protected],” where the “foo” part could be absolutely anything and the second part is the name of the machine that assigned the ID. Sometimes, but not often, the “foo” part includes the sender’s username. Any e-mail in which the message ID is malformed (e.g., an empty string or no @ sign) or in which the site in the message ID is not the real site of origin is probably a forgery. • In-Reply-To: A Usenet header that occasionally appears in mail, the “In-Reply-To” header gives the message ID of the message to which it is replying. It is unusual for this header to appear except in e-mail directly related to Usenet; spammers have been known to use it, probably in an attempt to evade filtration programs. • MIME-Version: Another MIME header, this one specifies the version of the MIME protocol that was used by the sender. • Newsgroups: This header appears only in e-mail that is connected with Usenet—either e-mail copies of Usenet postings or e-mail replies to postings. In the first case, it specifies the newsgroup(s) to which the message was posted; in the second, it specifies the newsgroup(s) in which the message being replied to was posted. • Organization: This is a completely free-form header that normally contains the name of the organization through which the sender of the message has net access. The sender can generally control this header, and silly entries are commonplace. • Priority: This is an essentially free-form header that assigns a priority to the mail. Most software ignores it. It is often used by spammers in an attempt to get their messages read. • References: The “References” header is rare in e-mail except for copies of Usenet postings. Its use on Usenet is to identify the upstream posts to which a message is a response; when it appears in e-mail, it is usually just a copy of a Usenet header. It may also appear in e-mail responses to Usenet postings, giving the message ID of the post being responded to as well as the references from that post. • Reply-To: This header specifies an address for replies to go to. Though this header has many legitimate uses, it is also widely used by spammers to deflect criticism. Occasionally, a naive spammer will actually solicit responses by e-mail and use the “Reply-To” header to collect them, but more often the address specified in junk e-mail is either invalid or an innocent victim. • Sender: This header is unusual in e-mail (“X-Sender” is usually used instead), but appears occasionally, especially in copies of Usenet posts. It should identify the sender; in the case of Usenet posts, it is a more reliable identifier than the “From” line. • Subject: This is a completely free-form field specified by the sender to describe the subject of the message. • To: This header specifies whom the message is to. Note that the “To” header does not always contain the recipient’s address. X-headers is the generic term for headers starting with a capital X and a hyphen. The convention is that X-headers are nonstandard and provided for information only, and that, conversely, any nonstandard informative header should be given a name starting with X-. This convention is frequently violated. The following are some common X-headers: • X-Confirm-Reading-To: This header requests an automated confirmation notice when the message is received or read. It is typically ignored, though some software acts on it. • X-Distribution: In response to problems with spammers using his software, the author of Pegasus added this header. Any message sent with Pegasus to a sufficiently large number of recipients has a header added that says “X-Distribution: bulk.” It is explicitly intended as something for recipients to filter against. • X-Errors-To: Like “Errors-To,” this header specifies an address for errors to be sent to. • X-Mailer: This is a free-form header field intended for the mail software used by the sender to identify itself (as advertising or whatever). Since much junk e-mail is sent with mailers invented for that purpose, this field can provide much useful fodder for filters. • X-PMFLAGS: This is a header added by Pegasus; its semantics are nonobvious. It appears in any message sent with Pegasus, so it doesn’t obviously convey any information to the recipient.

Investigating E-Mail Crimes and Violations

Figure 7-10

7-15

The Outlook directory contains a user’s e-mail database.

• X-Priority: This is another priority field, used notably by Eudora to assign a priority (which appears as a graphical notation on the message). • X-Sender: The usual e-mail analogue to the Sender: header in Usenet news, this header identifies the sender with greater reliability than the “From” header. In fact, it is nearly as easy to forge and should therefore be viewed with the same sort of suspicion as the “From” header. • X-UIDL: This is a unique identifier used by POP for retrieving mail from a server. It is normally added between the recipient’s mail server and the recipient’s mail client; if mail arrives at the mail server with an “X-UIDL” header, it is probably junk.

Examining Additional Files E-mail storage depends on the state of the client and server computers. Some e-mail programs permit the user to store e-mail on a server and some on the client computer. Various e-mail clients allow the user to save all his or her e-mail messages in a separate folder that can later be accessed from anywhere without logging on to the user’s e-mail client.

Microsoft Outlook Microsoft Outlook acts like a personal information manager, maintaining all information related to e-mail. The e-mail database is usually located in the <user home>\Local Settings\Application Data\Microsoft\Outlook directory. These are typically hidden files. Figure 7-10 shows the contents of this directory. Microsoft Outlook gives the user the advantage to save all e-mail messages in the following two file locations: • Personal e-mail file (.pst) • Offline e-mail file (.ost)

Online E-Mail Programs Online e-mail programs such as AOL, Hotmail, and Yahoo! leave the files containing e-mail messages on the computer. These files are stored in different folders such as History, Cookies, Temp, Cache, and Temporary Internet Folder. Investigators can use forensic tools to retrieve the folder for the respective e-mail client. Once the folder is retrieved, the investigator can open the files to find information about the suspect e-mails.

Personal Address Book Another feature of e-mail programs that can prove to be useful is the personal address book. A suspect’s personal address book can become supporting evidence that can indicate the suspect’s involvement in a crime.

7-16

Chapter 7

Source: http://www.centralops.net. Accessed 2/2007.

Figure 7-11

This screenshot shows e-mail validation results from Email Dossier.

Examine the Originating IP Address The following are the steps involved in examining the originating IP address: 1. Collect the IP address of the sender from the header of the received mail. 2. Search for the IP in the WHOIS database. 3. Look for the geographic address of the sender in the WHOIS database.

Tool: Email Dossier Email Dossier is part of the CentralOps.net suite of online network utilities. It is a scanning tool that an investigator can use to check the validity of an e-mail address. It provides information about the e-mail address, including the mail exchange records of the e-mail address. This tool initiates SMTP sessions to check address acceptance, but it never actually sends e-mail. Figure 7-11 shows a screenshot from Email Dossier.

Tool: Exchange Message Tracking Center This tool can help an investigator track a message’s path between servers, as well as determine when the user sent the message, to whom the user sent the message, and other important pieces of information. Using the Exchange Message Tracking Center is fairly straightforward and is similar to searching through Active Directory. Most administrators should have no problem quickly finding messages they are looking for, provided that their logs date back far enough to support finding the message in question. Figure 7-12 shows a screenshot from Exchange Message Tracking Center.

Tool: MailDetective MailDetective is an effective tool for monitoring corporate e-mail usage in Microsoft Exchange Server. The following are some of the uses of MailDetective: • Monitors e-mail usage to check for employees who use e-mail services for non-work-related communications • Helps management cut down on costs incurred due to misuse of bandwidth • Monitors mail server log files and gives detailed reports about business and private e-mails going to and from the corporate network • Gives a report of the traffic distribution by users and e-mail addresses

Using Specialized E-Mail Forensic Tools

7-17

Figure 7-12 Exchange Message Tracking Center allows an administrator to search for messages based on a number of criteria.

The following are some of the features of MailDetective: • Built-in HTML browser • Charts (Figures 7-13 and 7-14) • Ability to export reports to HTML • Ability to print reports directly from the built-in browser • Ability to export reports to Microsoft Excel format • Tools for automatic log file import and report creation • Ability to send reports through e-mail

Examine Phishing The following are the steps involved in examining phishing: 1. Search for any e-mails received that contain malicious links to Web sites. 2. Check the link in the phishing archive in the Honeytrap database tool (Figures 7-15 and 7-16).

Using Specialized E-Mail Forensic Tools During e-mail investigation, an e-mail administrator has a key role to play in providing information such as log files and retrieving deleted files. An investigator also relies on forensic tools. Sophisticated forensic tools, such as AccessData’s Forensic Toolkit (FTK) and EnCase, are specially designed for data recovery from hard drives, while tools like FINALeMAIL and Sawmill are specifically built for e-mail recovery, including attachments recovery. An investigator can use data recovery tools such as FTK and EnCase to locate log files, mail database files, personal e-mail files, and offline storage files. These data recovery tools extract the data from the mail server and permit the investigator to see the evidence on the machine itself. A text editor or special viewer program

7-18

Chapter 7

Source: http://www.advsoft.info/products/maildetective/. Accessed 2/2007.

Figure 7-13 MailDetective allows users to specify different options for chart displays.

Source: http://www.advsoft.info/products/maildetective/. Accessed 2/2007.

Figure 7-14

MailDetective can display data as charts.

Using Specialized E-Mail Forensic Tools

7-19

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 7-15

This is information about a particular phishing attempt.

Figure 7-16 This is the Web site that is linked to in the phishing attempt described by Figure 7-15.

can open the recovered files. This e-mail log information can be compared with the victim’s e-mail message, and once it is verified, this information can serve as evidence.

Tool: Forensic Toolkit (FTK) FTK has file-filtering and search functionality. FTK’s customizable filters allow investigators to sort through thousands of files to quickly find the evidence they need. FTK has the following features: • Supports Outlook, Outlook Express, AOL, Earthlink, Netscape, Yahoo!, Eudora, Hotmail, Thunderbird, and MSN e-mail • Generates audit logs and case reports • Provides full text indexing that yields instant text search results • Provides advanced searches for JPEG images and Internet text • Locates binary patterns

7-20

Chapter 7

Figure 7-17 FINALeMAIL recovers e-mails deleted from Outlook Express and Eudora.

• Automatically recovers deleted files and partitions • Targets key files quickly by creating custom file filters • Supports NTFS, FAT12, FAT16, FAT32, ext2, ext3, HFS, HFS⫹, and Reiser FS 3 file systems • Supports EnCase, SnapBack, Safeback (up to but not including version 3), Expert Witness, ICS, and Linux DD image file formats • Allows an investigator to view, search, print, and export e-mail messages and attachments • Recovers deleted and partially deleted e-mails • Automatically extracts data from PKZIP, WinZip, WinRAR, GZIP, and TAR compressed files

Tool: FINALeMAIL FINALeMAIL can scan e-mail databases to locate deleted e-mails that do not have any data location information. This tool can recover e-mails lost through virus infection, accidental deletion, and disk formatting. FINALeMAIL not only restores single messages to their original state but also has the capability to restore whole database files. FINALeMAIL supports Outlook Express and Eudora. Figure 7-17 shows a screenshot from FINALeMAIL.

Tool: R-Mail R-Mail is an e-mail recovery tool. It restores deleted Outlook and Outlook Express e-mail messages. R-Mail can also recover Outlook and Outlook Express data files if they have been damaged. Recovered data are stored in .eml, .pst, or .msg format so they can be imported into Outlook or Outlook Express. An investigator can also view recovered messages within R-Mail. This tool is of vital importance if a suspect has deleted e-mail messages intentionally. Figure 7-18 shows a screenshot from R-Mail.

Tool: E-Mail Detective E-Mail Detective allows investigators to extract all e-mail contents (including graphics) from cached AOL e-mails stored on a user’s disk drive. An investigator can run E-Mail Detective from a USB jump drive for field investigations.

Using Specialized E-Mail Forensic Tools

7-21

Source: http://www.outlook-mail-recovery.com/. Accessed 2/2007.

Figure 7-18

An investigator can browse recovered e-mails in R-Mail.

Figure 7-19

E-mail Examiner allows investigators to view recovered e-mails.

Tool: E-mail Examiner by Paraben E-mail Examiner allows investigators to recover deleted e-mail messages. It can even recover deleted messages that have been removed from the Deleted Items folder. E-mail Examiner supports over 15 different mail types, including AOL, Microsoft Outlook, Eudora, Mozilla, MSN, and Pegasus. Figure 7-19 shows a screenshot from E-mail Examiner.

7-22

Chapter 7

Figure 7-20 Network E-mail Examiner can show all information associated with a particular e-mail.

Tool: Network E-mail Examiner by Paraben Network E-mail Examiner allows an investigator to examine a variety of network e-mail archives. This tool views all the individual e-mail accounts in e-mail stores and the associated metadata. Network E-mail Examiner reads Microsoft Exchange, Lotus Notes, and Novell GroupWise e-mail stores. Network E-mail Examiner is designed to work with E-mail Examiner. The outputs are compatible, so an investigator can load one tool’s output into the other tool for further analysis. Figure 7-20 shows a screenshot from Network E-mail Examiner.

Tool: Recover My Email for Microsoft Outlook Recover My Email for Microsoft Outlook is an e-mail recovery tool. The following are some of its features: • Recovers individual e-mail messages and attachments deleted from a Microsoft Outlook e-mail file • Scans an Outlook .pst file to see what e-mail can be recovered • Saves deleted messages and attachments into a new .pst file • Converts .pst files to .ost files

Tool: Diskinternals Outlook Recovery Outlook Recovery restores messages and attachments that have been deleted from the Deleted Items folder in Outlook. It also repairs damaged .pst and .ost files for all versions of Outlook. Outlook Recovery can scan an entire hard drive for damaged Outlook database files. It can often even restore files on damaged hard drives. Figure 7-21 shows a screenshot from Outlook Recovery.

Trace the E-Mail Tracing e-mail begins with looking at the message header. All e-mail header information can be faked except the “Received” portion referencing the victim’s computer (the last received).

Using Specialized E-Mail Forensic Tools

7-23

Figure 7-21 Users can view recovered e-mails using Outlook Recovery’s internal viewer.

Once it is confirmed that the header information is correct, the investigator can use the originating e-mail server as the primary source. The investigator can get a court order served by law enforcement or a civil complaint filed by attorneys. The investigator can use the court order to obtain the log files from the server in order to determine the sender. After getting contact information about the suspect, the investigator can take punitive steps against the suspect.

Validating Header Information Once it is established that a crime has been committed, the investigator can use the IP address of the originating source to track down the owner of the e-mail address. The suspect can provide fake information. An investigator should always validate the information first. The following are some acceptable sites that an investigator can use to find the person owning a domain name: • www.arin.net: This site employs the American Registry for Internet Numbers (ARIN) to match a domain name with an IP address. It also provides the point of contact for the domain name. • www.internic.com: It provides the same information given by www.arin.net. • www.freeality.com: This site provides various types of searches, including those for e-mail addresses, physical addresses, phone numbers, and names. An investigator can do a reverse e-mail search, which could reveal a suspect’s real name. • www.google.com: An investigator can use this all-purpose search engine to find many different types of information. The investigator can search both Web sources and newsgroup sources. These Web sites can assist in tracing an e-mail message by providing essential pieces of information, such as a suspect’s contact information.

Tracing Web-Based E-Mail It can be difficult to trace the sender of Web-based e-mail. A user can read and send this type of e-mail from any computer and from any part of the world. Web-based e-mail accounts are free, and no authentic information

7-24

Chapter 7

is required for creating an e-mail account. Criminals exploit this advantage and create e-mail accounts using false identities. In case a Web-based e-mail account is used for sending offending messages, an investigator can contact the provider of the account to find the IP address of the user who connected to the Web site to send the mail. After performing IP address authentication, the investigator can get the sender’s information.

Searching E-Mail Addresses After getting the suspect’s contact information, such as e-mail address, name, and phone number, the investigator can use various Internet search engines to find more information about the suspect. The following search engines are used for searching for e-mail addresses: • http://www.dogpile.com: This site searches all the most popular engines and then provides more comprehensive and relevant results. The site provides a comprehensive background report that has all the information about a suspect, including age, current and previous addresses, phone number, occupation, bankruptcies, tax liens and judgments, and property ownership. • http://www.searchscout.com: This is a powerful tool that assists in tracing an offender by delivering relevant search results for keyword queries and giving ample search options to investigators. This search site provides investigators with the option to look up e-mail addresses and trace e-mails back to the source. It has powerful lookup tools, an e-mail directory, and an in-depth guide for advanced searching so an investigator can find names connected to street addresses, phone numbers, and e-mail addresses. • http://www.altavista.com: This site allows an investigator to search for a suspect based on various criteria, including name, phone number, and e-mail address. • http://www.mamma.com: This is a metasearch engine, which concurrently searches a variety of engines and directories and provides the most relevant results after eliminating duplicate information. It provides various options to allow an investigator to refine the search. • http://www.infospace.com: This site has a reverse lookup option that makes tracing e-mails easy and quick. An investigator can refer to e-mail directories and public records while investigating a suspect. • http://www.emailaddresses.com: This is a free e-mail address directory. It provides a wide range of search criteria, such as reverse lookup and search by city, state, and business. Any single piece of information can be used to retrieve a suspect’s information. • http://www.google.com: This search engine serves as a convenient way for tracing e-mails. The people search has two criteria: phone number and e-mail address. An investigator can also perform an instant background check. Many popular e-mail search sites use this search engine.

Tool: LoPe LoPe (Figure 7-22) is an e-mail forensic tool that has the following features: • It extracts all e-mail messages and attachments from multiple .pst files. • It recreates the internal .pst folder structure. • It extracts all message headers and properties. • Files are exported in MSG, EML, or XML format. • It hashes every message and attachment. • It offers a command-line interface so it can be easily batch scripted. • LoPe allows a user to customize XML output format using XSL style sheets.

Tool: eMailTrackerPro eMailTrackerPro analyzes e-mail headers and provides the IP address of the machine that sent the e-mail. It also provides the graphical location of that IP address so an investigator can track down the sender (Figure 7-23). eMailTrackerPro also protects users from spam by blocking mail that comes from blacklisted sites. Users can also easily report e-mail abuse. eMailTrackerPro can create a report and send it to the offending user’s ISP.

Using Specialized E-Mail Forensic Tools

Source: http://www.evidencetalks.com/. Accessed 2/2007.

Figure 7-22

Figure 7-23

LoPe can extract e-mails from multiple .pst files.

eMailTrackerPro analyzes e-mail headers.

7-25

7-26

Chapter 7

Tool: ID Protect ID Protect protects a domain owner’s contact information from becoming public. The WHOIS database contains a domain owner’s address, phone number, and other private information. ID Protect’s dynamic e-mail system constantly changes the e-mail address visible in the WHOIS database, so any spammer that harvests the address will get an invalid address. A user’s private information is held in confidentiality and protected by the Domain Privacy Protection Service. The Domain Privacy Protection Service secures and maintains the user’s real e-mail address on file so he or she receives important information regarding his or her domain. A domain name with ID Protect can shield a user from the following: • Domain-related spam • Identity theft • Data mining • Name hijackers

U.S. Laws against E-Mail Crime: CAN-SPAM Act The CAN-SPAM Act of 2003 (Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003) does the following: • Establishes requirements for individuals and organizations that send commercial e-mail • Details the penalties for violating the law • Gives consumers the right to request that spammers stop contacting them The law pertains to e-mail whose primary purpose is advertising or promoting a commercial product or service, including content on a Web site. The following are the main provisions of this act: • Header information must be accurate. The sender and recipient e-mail addresses must be correct. • Subject lines must not be misleading. The subject of the message must relate to the content of the message. • E-mail recipients must be given a way to opt out of receiving further messages. This method must be spelled out in each e-mail message. • Any commercial e-mail must identify itself as an advertisement or solicitation. It must also include the individual or organization’s physical address. The following are the penalties for violating the provisions of this act: • Each violation is subject to fines of up to $11,000. Commercial e-mail is also subject to laws banning false or misleading advertising. • Commercial e-mailers who also do the following are subject to additional fines: • Harvest e-mail addresses from Web sites that have posted a notice prohibiting the transfer of e-mail addresses • Generate e-mail addresses using a dictionary attack • Use automated methods to register for multiple e-mail accounts to send commercial e-mail • Relay e-mails through a computer or network without permission The law allows the Department of Justice to seek criminal penalties for commercial e-mailers who do the following: • Use someone else’s computer without authorization and send commercial e-mail from it • Use a computer to relay or retransmit multiple commercial e-mail messages in an attempt to mislead recipients about the origin of the message • Falsify header information in multiple e-mail messages and send those messages • Register for multiple e-mail accounts or domain names using false identification information

Chapter Summary

7-27

U.S. Law: 18 U.S.C. § 2252A This law pertains to child pornography. The following are the provisions of the law: • A person cannot knowingly transport by any means, including but not limited to through the mail or through a computer, child pornography. • A person cannot knowingly receive or distribute child pornography that has been transported by any means, including but not limited to through the mail or through a computer. • A person cannot knowingly reproduce any child pornography for distribution by any means, including but not limited to through the mail or through a computer. • A person cannot advertise, promote, present, distribute, or solicit child pornography. • A person cannot knowingly possess or sell child pornography in any form, including books, magazines, films, and digital media. The penalties for violating this law are fines and a prison sentence of between 5 and 20 years.

U.S. Law: 18 U.S.C. § 2252B This law pertains to misleading domain names on the Internet. The following are the provisions of this law: • A person cannot knowingly use a misleading domain name on the Internet with the intent to deceive a person into viewing obscene material. This does not include using a domain name containing sexual terms that indicate the sexual content of the site. The penalty for violating this provision is a fine, imprisonment for no longer than 2 years, or both. • A person cannot knowingly use a misleading domain name on the Internet with the intent to deceive a minor into viewing material that is harmful to minors. The penalty for violating this provision is a fine, imprisonment for no longer than 4 years, or both.

E-Mail Crime Law in Washington: RCW 19.190.020 This law prohibits unpermitted or misleading e-mail. The provision of this law is that a person cannot knowingly send a commercial e-mail from a computer located in Washington or to an e-mail address held by a Washington resident that does one of the following: • Uses someone else’s Internet domain name without permission or otherwise tries to hide the origin of the e-mail or the path the e-mail took • Contains a false or misleading subject line

Chapter Summary ■

E-mail crimes are those crimes that use e-mail to perpetrate the crime or that are supported by e-mail.

■

Spammers obtain e-mail addresses by harvesting addresses from Usenet postings, DNS listings, and Web pages.

■

Chat rooms can also be used as a social engineering tool to collect information for committing crimes.

■

Phishers use fake Web sites to obtain users’ personal information.

■

E-mail spoofing is the forgery of an e-mail header so that the message appears to have originated from someone or somewhere other than the actual source.

7-28

Chapter 7

Review Questions 1. What is spam? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 2. Describe the differences between IMAP and POP3. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 3. List six examples of e-mail crimes. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 4. List the steps involved in investigating e-mail crimes. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 5. What is the purpose of examining e-mail headers? What can they tell an investigator? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 6. What is phishing? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 7. What are the steps involved in tracing an e-mail? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 8. Name four common headers and their purposes. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 9. Describe the provisions of the CAN-SPAM Act of 2003. ___________________________________________________________________________________________ ___________________________________________________________________________________________

Hands-On Projects 1. Perform the following steps: ■

Navigate to Chapter 7 of the Student Resource Center.

■

Install and launch FINALeMAIL.

■

Explore the various options of this program.

Hands-On Projects

2. Perform the following steps: ■

Navigate to Chapter 7 of the Student Resource Center.

■

Install and launch E-Mail Detective.

■

Explore the various options of this program.

3. Perform the following steps: ■

Navigate to Chapter 7 of the Student Resource Center.

■

Install and launch Spam Arrest.

■

Track an e-mail address.

7-29

This page intentionally left blank

Chapter

8

Investigating Corporate Espionage

Objectives After completing this chapter, you should be able to: • • • • • • •

Understand corporate espionage Describe the motives behind spying Understand the information that corporate spies seek Understand the causes of corporate espionage Describe spying techniques Defend against corporate spying Understand the tools used to fight against corporate espionage

Key Terms Corporate espionage the use of spies to gather information about the activities of an organization for commercial purposes Honeypot a system that is attractive to an attacker and serves no other purpose than to keep attackers out of critical systems and observe their attack methods Honeytoken a file that an administrator places on a server that serves no other purpose than to attract the attention of an attacker Netspionage network-enabled espionage, in which an attacker uses the Internet to perform corporate espionage

Introduction to Investigating Corporate Espionage This chapter focuses on the various aspects of corporate espionage and strategies to prevent and investigate such cases. Espionage is the use of spies to gather information about the activities of an organization. Information gathered through espionage is generally confidential information that the source does not want to divulge or make public. The term corporate espionage is used to describe espionage for 8-1

8-2

Chapter 8

commercial purposes. Corporate espionage targets a public or private organization to determine its activities and to obtain market-sensitive information such as client lists, supplier agreements, personnel records, research documents, and prototype plans for a new product or service. This information, if leaked to competitors, can adversely affect the business and market competitiveness of the organization. It is widely believed that corporate espionage is a high-tech crime committed by highly skilled persons. On the contrary, corporate penetration is accomplished with simple and preventable methods. Corporate spies do not depend on computer networks alone for information; they look for the easiest ways to gather information. Even trash bins and scrap bits of papers can be of great help in collecting sensitive information. Spies look for areas that are generally ignored. For example, they take advantage of people’s negligence, such as forgetting to close doors or leaving scrap or waste paper around that contains sensitive information. Market research and surveys show the severity of corporate espionage. According to the FBI and other similar market research organizations, U.S. companies lose anywhere from $24 billion to $100 billion annually due to industrial espionage and trade secret thefts, whereas technical vulnerabilities are responsible for just 20% or less of all losses.

Motives Behind Spying The motives behind spying include the following: • Financial gain: The main purpose of corporate espionage is financial gain. Any company’s trade secrets can be sold for millions of dollars. Competitors can use the stolen information to leverage their market position and obtain great financial benefits. • Professional hostilities: Professional hostilities are also a result of market competition. Competitors often resort to negative publicity of an organization’s issues, which otherwise may have been kept secret and sorted out in time. There have been many instances when a rival company has disclosed secret information collected through corporate espionage of an organization, resulting in plummeting stocks and drastic decrease in market capitalization. • Challenge and curiosity: People sometimes indulge in corporate espionage just for fun and to test their skills. Students of security programs and researchers often try to reenact corporate espionage. Though not disastrous, it compromises corporate information security. • Personal relations: Many times, a corporate spy is motivated by personal or nonideological hostility toward the country or organization. Personal hostilities of disgruntled employees and job seekers toward an organization play a major role in almost all corporate espionage cases. The offenders reveal important, sensitive information to others out of spite.

Information That Corporate Spies Seek The following are some of the types of information that corporate spies seek: • Marketing and new product plans • Source code of software applications: It can be used to develop a similar application by a competitor or to design a software attack to bring down the original application, thus causing financial losses to the original developer. • Corporate strategies • Target markets and prospect information • Business methods • Product designs, research, and costs: Huge investments will be in vain if the product design and related research is stolen, because the competitor can also develop the same product and offer it for less. • Alliance and contract arrangements: delivery, pricing, and terms • Customer and supplier information • Staffing, operations, and wages or salaries • Credit records or credit union account information

Techniques of Spying

8-3

All of the above information is considered crucial for the success of an organization. Information leaks could have catastrophic effects on organizations.

Corporate Espionage: Insider/Outsider Threat Corporate espionage threats can be classified into the following two basic categories: • Insiders: Insiders such as IT personnel, contractors, and other disgruntled employees who can be lured by monetary benefits are the main targets of corporate spies. An insider threat is always considered more potent than an outsider threat because insiders have legitimate access to the facilities, information, computers, and networks. According to the available study reports, almost 85% of espionage cases originate from within an organization. Insiders can easily misuse their privileges to leak sensitive information, and they can collaborate with an outsider. There are several factors that may prompt an insider to sell information to a competitor or spy, such as the following: • Lack of loyalty • Job dissatisfaction • Boredom • Mischief • Money • Outsiders: Outsiders include corporate spies and attackers who have been hired by a competing organization or are motivated by personal gain. These people try to intrude into an organization’s affairs for the purpose of stealing sensitive information. An outsider can enter a company through Internet connection lines, physical break-ins, or partner (vendor, customer, or reseller) networks of the organization.

Corporate Espionage Threat Due to Aggregation of Information Espionage is a great threat to organizations that practice information aggregation, where all information concerning an organization is brought together and stored in one location. Both insiders and outsiders can easily access critical information because there is only one point of infiltration. In an insider attack, insiders with access privileges can tamper with, edit, overwrite, or send critical information to the organization’s competitors. In an outsider attack, an outsider who breaks into the private network of an organization can search, aggregate, and relate all the organization’s critical information.

Techniques of Spying The following are some common spying techniques: • Hacking computers and networks: This is an illegal technique for obtaining trade secrets and information. Hacking involves gaining unauthorized access to computers and networks. • Social engineering: Social engineering is the use of influence and the art of manipulation to gain credentials. Individuals at any level of business or communicative interaction can make use of this method. All the security measures that organizations adopt are in vain when employees get socially engineered by strangers. Some examples of social engineering include unwittingly answering the questions of strangers, replying to spam e-mail, and bragging to coworkers. • Dumpster diving: Dumpster diving is searching for sensitive information in the following places at a target organization: • Trash bins • Printer trash bins • User desks • Whacking: Whacking is wireless hacking that is used to capture information passing through a wireless network. • Phone eavesdropping: Phone eavesdropping is overhearing phone conversations while being physcially present.

8-4

Chapter 8

• Network leakage: Most organizations set up their network to block or limit inbound and outbound connections. Even organizations that are starting to filter outbound traffic still allow certain traffic out. Two types of traffic that are always allowed out of an organization are Web and e-mail traffic. • Cryptography: Cryptography is a technique to garble a message in such a way that the meaning of the message is changed. Cryptography starts with a plaintext message, which is a message in its original form. An encryption algorithm garbles a message, which creates ciphertext. A decryption algorithm can later take the ciphertext and convert it back to a plaintext message. During the encryption and decryption process, what protects the ciphertext and stops someone from inadvertently decrypting it back to the plaintext message is the key. Therefore, the secrecy of the ciphertext is based on the secrecy of the key and not the secrecy of the algorithm. Thus, to use an encryption program, a user has to generate a key. The key is often tied to a username and e-mail address. No validation is performed, so an attacker can put in bogus information that could be used later to launch a man-in-the-middle attack where the attacker can trick someone into using a false key. If someone knows the public key for a user, he or she can encrypt a message; but he or she can only decrypt the message if he or she knows the user’s private key. The public key can be distributed via a trusted channel, but a user’s private key should never be given out. If someone can get access to a user’s private key, he or she can decrypt and read all that user’s messages. • Steganography: Steganography is data hiding and is meant to conceal the true meaning of a message. With steganography, a user has no idea that someone is even sending a sensitive message because he or she is sending an overt message that completely conceals and hides the original covert message. Therefore, cryptography is often referred to as secret communication and steganography is referred to as covert communication. Insiders often use steganography to transmit credentials to other organizations.

Defense Against Corporate Spying The following are some techniques that can secure the confidential data of a company from spies: • Controlled access • Encrypt the most critical data. • Never store sensitive information on a networked computer. • Classify the sensitivity of the data and thus categorize personnel access rights to read/write the information. • Assign duties to personnel where their need-to-know controls should be defined. • Ensure authorization and authentication to critical data. • Install antivirus software and password-protect the secured system. • Regularly change the password of confidential files. • Separate duties. • Background investigations of personnel • Verify the background of new employees. • Do not ignore physical security checks. • Monitor employee behavior. • Monitor systems used by employees. • Disable remote access. • Make sure that unnecessary account privileges are not allotted to normal users. • Disable USB drives on employees’ systems. • Enforce a security policy that addresses all employee concerns. The following are the basic security measures to protect against corporate spying: • Destroy all paper documents before trashing them. Secure all dumpsters and post “NO TRESPASSING” signs. • Regularly conduct security awareness training programs for all employees.

Steps to Prevent Corporate Espionage

8-5

• Place locks on computer cases to prevent hardware tampering. • Lock the wire closets, server rooms, phone closets, and other sensitive equipment. • Never leave a voice mail message or e-mail broadcast message that gives an exact business itinerary. • Install electronic surveillance systems to detect physical intrusions.

Steps to Prevent Corporate Espionage The following sections outline some steps that help in preventing corporate espionage.

Understand and Prioritize Critical Assets An administrator needs to determine the criteria that are used to estimate value. Monetary worth, future benefit to the company, and competitive advantage are sample criteria that could be used. Whatever the criteria are, they need to be determined first. After all assets are scored, the administrator needs to prioritize them based on the criteria. When the administrator is done, he or she should have a list of all the critical assets across the organization. These assets represent the crown jewels of the organization and need to be properly protected. Once the list of assets has been determined, the critical assets need to be protected. An administrator needs to understand the likely attack points and how an attacker would compromise each asset.

Define Acceptable Level of Loss The possibility for loss is all around, and risk management becomes a driving factor in determining what an organization should focus its efforts on and what can be ignored. As difficult as it may seem for all critical assets, an adequate level of risk needs to be defined. This helps an organization to focus on what should or should not be done with regard to insider threats. Cost-benefit analysis is a typical method of determining the acceptable level of risk. The general premise behind cost-benefit analysis is determining what the cost is if the asset is lost in part or in whole, versus what the cost is to prevent that loss. While this is hard for some people to swallow, there are actually many situations where it is more cost effective to do nothing about the risk than to try to prevent or reduce the risk from occurring. Typically, there are two methods to deal with potential loss: prevention and detection. Preventive measures are more expensive than detective measures. With a preventive measure, the organization stops the risk from occurring. With detective measures, the organization allows the loss to occur but detects it in a timely manner to reduce the time period in which the loss occurs. Defining an acceptable level of loss enables an organization to determine whether it should implement preventive or detective measures. If the organization’s acceptable level of loss is low, which means it has a low tolerance for a loss of a given asset, a preventive measure would be more appropriate to stop the loss. The organization would have to be willing to spend the extra money on appropriate preventive measures. If the organization’s acceptable level of loss is high, this means it has a higher tolerance and would most likely spend less money on a solution and implement detective measures. Now, the organization is allowing the loss to occur, but it is controlling and bounding it. Therefore, performing calculations on acceptable level of loss plays a critical role in controlling insider threats.

Control Access The best method for controlling insider threats is limiting and controlling access. In almost every situation in which an insider compromises, it is usually because someone had more access than he or she needed to do his or her job. There are usually other factors at play, but the number one factor is properly controlling access. For preventing insider attack, it is better to allocate someone the least amount of access that he or she needs to do his or her job. Encrypt the most critical data. Never store sensitive information on a networked computer; store confidential data on a standalone computer that has no connection to other computers and the telephone line. Regularly change the password of confidential files.

Bait: Honeypots and Honeytokens A honeypot is a system that is put on a network that has no legitimate function. It is set up to look attractive to attackers and keep them out of critical network systems. The key thing about a honeypot is that there is no legitimate use for it, so no one should be accessing it. If someone accesses the honeypot in any way, that person is automatically suspicious because the only way he or she could have found it is if he or she was wandering around

8-6

Chapter 8

the network looking for something of interest. If the attacker was only doing what he or she was supposed to, he or she would have never found the system. Note that there are some legal ramifications to using honeypots. If the honeypot is used to protect critical systems and to observe attack methods to be able to better protect network systems, it is simply enticement to provide the attacker with a more attractive target. If, on the other hand, the intent is to lure or trick the attacker into attacking the system so an administrator can catch and prosecute the attacker, it could be considered entrapment, which is illegal. A honeytoken works the same way as a honeypot, but instead of an entire system, it is done at the directory or file level. An administrator puts an attractive file on a legitimate server and if anyone accesses it, the administrator catches the attacker with his or her hand in the cookie jar. This usually has a higher payoff. Insiders are good at figuring out a certain system or even a certain directory that contains critical intellectual property for a company. If an administrator adds an additional file to the system or directory, there is a chance that someone might stumble across it. Once again, since this is not a legitimate file, no one should be accessing it. There is no speculation involved if someone accesses the honeytoken file. That person is clearly up to no good since there is no reason anyone should be accessing it. Therefore, honeytokens can enable administrators to set up a virtual minefield on critical systems. If a person is a legitimate user and knows the files he or she is supposed to access, he or she can easily navigate the minefield and not set off any mines; however, if a user is an insider trying to cause harm, there is a good chance that he or she will be tempted by a honeytoken.

Detect Moles With mole detection, an administrator gives a piece of data to a person and if that information makes it out to the public domain, the administrator knows the organization has a mole. If an administrator suspects that someone is a mole, he or she could “coincidentally” talk about something within earshot of the suspect. If the administrator hears the information being repeated somewhere else, he or she knows that person is the mole. Mole detection is not technically sophisticated, but it can be useful in trying to figure out who is leaking information to the public or to another entity.

Perform Profiling An ideal way to control and detect insiders is by understanding behavioral patterns. There are two general types of profiling that can be performed: individual and group. Individual profiling is related to a specific person and how he or she behaves. Every person is unique, so individual profiling learns the pattern of normality for a given individual, and if any behavior falls outside of that norm, that person is flagged. The advantage of this method is that it closely matches to an individual and is more customized to how a single individual acts. The problem is that it changes with the person, so if the attacker knows that individual profiling is being performed and makes slow, minor adjustments to his or her behavior, he or she could slip through the system.

Perform Monitoring Monitoring is easy to do and provides a starting point for profiling. With monitoring, an administrator is just watching behavior. In order to profile a given person and flag exceptional behavior, the administrator has to establish a baseline. Therefore, in many cases, it is better to start with monitoring to see how bad the problem is and then move toward profiling if that is deemed necessary at a later point in time. Before an organization performs monitoring, it is critical that it does it in a legal and ethical manner. From a legality standpoint, it is critical that an organization determines whether information has an implied expectation of privacy. The following are some of the different types of monitoring that an organization can perform: • Application specific • Problem specific • Full monitoring • Trend analysis • Probationary

Analyze Signatures Signature analysis is a basic but effective measure for controlling insider threats or any malicious activity. Signature analysis is also called pattern analysis because the administrator is looking for a pattern that is indicative of a problem or issue.

Investigating Corporate Espionage Cases

8-7

The problem with signatures is that an administrator must know about an attack in order to create a signature for it. The first time an attack occurs, it becomes successful because there is no signature. After it is successful and the administrator performs incident response and damage assessment, he or she can figure out how the attack occurred and can build an appropriate signature for the next time; however, if the next time the attacker attacks in a different manner, the signature might miss the attack again. This brings up two important points with regard to signatures. First, they will only catch known attacks; they will not catch zero-day attacks. A zeroday attack is a brand new attack that has not been publicized and is not well known. Second, signatures are rigid. If an administrator has a signature for an attack and it occurs exactly the same way each time, he or she can detect it and flag it. However, if it is morphed or changed, there is a good chance the signature will no longer be effective. The last problem with signatures is that they take a default allow stance on security. A default stance blocks what is malicious, and anything else that falls through is flagged as good. By itself, signature detection says if there is bad behavior but there is no signature match, then the behavior must be good.

Key Findings from U.S. Secret Service and CERT Coordination Center/SEI Study on Insider Threats A U.S. Secret Service and CERT Coordination Center/SEI study revealed the following things concerning insider threats: • A negative work-related event triggered most insiders’ actions. • The most frequently reported motive was revenge. • The majority of insiders planned their activities in advance. • Remote access was used to carry out a majority of the attacks. • Insiders exploited systematic vulnerabilities in applications, processes, and/or procedures, but relatively sophisticated attack tools were also employed. • The majority of insiders compromised computer accounts, created unauthorized backdoor accounts, or used shared accounts in their attacks. • The majority of attacks took place outside normal working hours. • The majority of the insider attacks were only detected once there was a noticeable irregularity in the information system or a system became unavailable. • The majority of attacks were accomplished using the company’s computer equipment. • The insiders not only harmed individuals but also the organizations.

Netspionage Netspionage is network-enabled espionage, in which an attacker uses the Internet to perform corporate espionage. Corporate espionage is an old practice, but the advent of the Internet has made it easier, faster, and much more anonymous. Netspionage enables spies to steal sensitive corporate information without physically entering the company’s premises.

Investigating Corporate Espionage Cases The following are some steps an investigator should take when investigating corporate espionage cases: 1. Check the possible points of physical intrusion: Before starting an investigation into a corporate espionage case, an investigator should scan all possible points of physical intrusion carefully. These points may provide clues about how the information might have leaked and can also provide fingerprints if anybody passed through. This information may be helpful when presenting the case before a court of law. 2. Check the CCTV records: An investigator should check all CCTV records for any unusual activity. This often leads to the real culprit. 3. Check e-mails and attachments: An investigator should check all official e-mails and other e-mails with attachments used at the workplace. In many cases, the information is passed outside using e-mails. An investigator should thoroughly scan any suspicious e-mail and try to find out its destination.

8-8

Chapter 8

4. Check systems for backdoors and Trojans: Disgruntled employees install backdoors and Trojans in their systems using their privileges as employees before quitting their jobs. So an investigator should scan all the systems and check for backdoors and Trojans. If any backdoor or Trojan is discovered, an investigator should trace its connections. 5. Check system, firewall, switch, and router logs: Logs show each and every event taking place in a network. An investigator should examine the logs of all network devices to detect suspicious activities, such as when and which data passed through the network and which kind of services and protocols were used. 6. Screen the logs of network and employee monitoring tools, if any: If an administrator has installed any kind of employee monitoring tools on the organization’s systems, an investigator should analyze their reports. But before using any such monitoring tools, the investigator must take care of any legal aspects. 7. Seek the help of law enforcement agencies, if required: An investigator should enlist the help of law enforcement agencies if it is necessary to track the culprit and bring him or her to trial.

Tool: Activity Monitor Activity Monitor allows an administrator to track how, when, and what a network user did on any LAN. The system consists of server and client parts. The following are some of the features of Activity Monitor: • Remotely views desktops • Monitors Internet usage • Monitors software usage • Records activity log for all workplaces on a local or shared network location. Log files include typed keystrokes, records of switching between programs with time stamps, application path, and window names, visited Web sites, and more. • Tracks any user’s keystrokes on an administrator’s screen in real-time mode. This includes passwords, e-mail, and chat conversations, as shown in Figure 8-1.

Source: http://www.softactivity.com/employee-monitoring.asp. Accessed 2/2007.

Figure 8-1

Activity Monitor can capture keystrokes in real time.

Tool: Track4Win

8-9

• Takes snapshots of remote PC screens on a scheduled basis • Total control over networked computers. An administrator can start or terminate remote processes, run commands, copy files from remote systems, turn off or restart remote systems, and log the current user off. • Deploys the client part of the software remotely from the administrator’s PC to all computers on the network • Automatically downloads and exports log files from all computers on a scheduled basis • Provides HTML, Excel, and CSV support to export data and reports • Monitors multiple employee computers simultaneously from a single workstation • Runs completely invisibly

Tool: Spector CNE Spector CNE provides an organization with a complete record of employee PC and Internet activity. Spector CNE collects information about every e-mail sent and received, every chat conversation and instant message, every Web site visited, every keystroke typed, and every application launched. It also provides detailed pictures of PC activity via periodic screen snapshots. The following are some of the features of Spector CNE: • It allows an administrator to monitor and conduct investigations on employees suspected of inappropriate activity. • It increases employee productivity by reducing frivolous and inappropriate activity. • It monitors and eliminates leaking of confidential information. • It monitors and recovers lost crucial communications (e-mails, chats, and instant messages). • It assists help desk staff with PC recovery. • It meets or exceeds federal, industry, and agency compliance requirements for keeping records of company communications and transactions. • It monitors ongoing employee performance and PC proficiency. • It obtains proof to support accusations of wrongdoing. • It reduces security breaches. • It detects the use of organization resources to engage in illegal or unethical activities. • It limits legal liability (including sexual and racial harassment). • It enforces PC and Internet acceptable-use policies.

Tool: Track4Win Track4Win monitors all computer activities and Internet use. With powerful network support, it can easily collect application running times (Figure 8-2), track Internet use information through the network, log this information in a database, analyze the information, and produce reports. The following are some of the features of Track4Win: • Employee’s current status monitoring • Multiuser and real-time monitoring • URL/Web site address capture and Web content tracking • Invisibility in Windows Task Manager The following are the technical features of Track4Win: • Data storage in Microsoft Access database format • Microsoft SQL Server upgradeable • Supports Microsoft Access, Microsoft SQL, Oracle, and ODBC database connections

8-10

Chapter 8

Source: http://www.track4win.com/. Accessed 2/2007.

Figure 8-2

Track4Win keeps track of application running times.

Tool: SpyBuddy SpyBuddy monitors the computer usage of employees. It enables an administrator to track every action on a PC, down to the last keystroke pressed or the last file deleted. SpyBuddy is equipped with the functionality to record all AOL/ICQ/MSN/AIM/Yahoo! chat conversations, all Web sites visited, all windows opened and interacted with, every application executed, every document printed, every file or folder renamed and/or modified, all text and images sent to the clipboard, every keystroke pressed, every password typed, and more. The following are some of the features of SpyBuddy: • Internet conversation logging: Logs both sides of all chat and instant message conversations • Disk activity logging: Records all changes made to hard drives and external media • Window activity logging: Captures information on every window that is viewed and interacted with • Application activity logging: Tracks every application that is executed and interacted with • Clipboard activity logging: Captures every text and image that is copied to the clipboard • Browser history logging: Views all Web sites visited before SpyBuddy was installed and when SpyBuddy was not recording • Printed documents logging: Logs specific information on all documents that are sent to the printer spool • Keystroke monitoring: Tracks all keystrokes pressed and which windows they were pressed in • Web activity logging: Logs all titles and addresses of Web sites that are visited • Screen capturing: Automatically captures screenshots of the desktop (or the active window) at set intervals • Web-site filtering: Creates Web site and protocol ban lists to prevent employees from viewing certain Web sites while SpyBuddy is active • Web-site monitoring: Manages a list of Web sites for SpyBuddy to monitor, and if a specified keyword/ phrase is found, it will record it • Password protection: SpyBuddy is password protected to prevent others from starting or stopping the monitoring process, as well as changing SpyBuddy configuration settings

Tool: Privatefirewall

8-11

• E-mail log delivery: SpyBuddy can periodically send the administrator recorded activity logs in a specified format (HTML/Excel/text/CSV/XML) and desktop screenshots at specified intervals • Scheduling agent: Automatically configures SpyBuddy to start or stop at specified times and dates, or configures it to perform at the same time every day of the week

Tool: NetVizor NetVizor is an employee monitoring solution. NetVizor allows an administrator to monitor the entire network from one centralized location. The administrator can track workstations, or he or she can track individual users who may use multiple systems on the network. The following are some of the features of NetVizor: • It logs keystrokes, Web site visits, searches, application usage, files, and document usage. • It logs Internet connections, chat conversations, windows opened, e-mail activities, Internet traffic data, uploads, and downloads. • It offers detailed user activity reports and network activity reports. • It offers real-time visual remote monitoring and Web-based remote control. • It disables spyware detectors. Figure 8-3 is a screenshot from NetVizor.

Tool: Privatefirewall Privatefirewall is a personal firewall and intrusion detection application that eliminates unauthorized access to a PC. Its interface allows users to create custom configurations. The following are some of the features of Privatefirewall: • Packet filtering • Port scanning • IP/Web site protection

Source: http://www.netvizor.net/. Accessed 2/2007.

Figure 8-3

This shows NetVizor’s main screen.

8-12

Chapter 8

Source: http://www.privacyware.com/personal_firewall.html. Accessed 2/2007.

Figure 8-4

Privatefirewall is a personal firewall application.

• E-mail anomaly detection • Advanced application protection Figure 8-4 shows a screenshot from Privatefirewall.

Tool: Internet Spy Filter Internet Spy Filter blocks spyware, Web bugs, worms, cookies, ads, scripts, and other intrusive devices. When a user is online, an attacker may be monitoring the user without his or her knowledge or explicit permission. These attackers may try to obtain private information about the user. Internet Spy Filter removes viruses and spyware, and acts as a personal firewall. Figure 8-5 shows Internet Spy Filter’s reporting feature.

Tool: Spybot—Search & Destroy Spybot—Search & Destroy detects and removes spyware. Spyware silently tracks a user’s Internet behavior. This tracking data is then often used to create a marketing profile for the user that is transmitted without the user’s knowledge and sold to advertising companies. Spybot—Search & Destroy can also clear usage tracks—a useful function if a user shares a computer with other users and does not want them to see what he or she has been working on. Figure 8-6 shows a screenshot from Spybot—Search & Destroy.

Tool: SpyCop SpyCop finds spy programs designed specifically to record screenshots, e-mail, passwords, and more. It detects and disables all known commercially available PC surveillance spy software products. The following are some of the features of SpyCop: • Stops password theft: It detects spy software that is placed on a computer to capture passwords. • Keeps e-mails private: It alerts the user if his or her e-mails are being snooped by spy software. • Kills instant message and chat spy software: It keeps online chats and instant messages safe from prying eyes.

Tool: SpyCop

8-13

Source: http://www.tooto.com/spyhunter/. Accessed 2/2007.

Figure 8-5

Internet Spy Filter reports on the spyware it has caught.

Figure 8-6

Spybot—Search & Destroy scans systems for spyware.

Source: http://www.safer-networking.org/en/spybotsd/index.html. Accessed 2/2007.

• Stops surfing monitors: SpyCop can prevent spy software from capturing and recording what Web sites a user is visiting. • Stops keyloggers: SpyCop protects users from spy software that can capture and record every keystroke. • Prevents online credit card theft: SpyCop can keep a user’s credit card information safe if he or she shops online. Figure 8-7 shows a screenshot from SpyCop.

8-14

Chapter 8

Source: http://www.spycop.com/. Accessed 2/2007.

Figure 8-7 SpyCop allows a user to specify different scan settings.

Tool: Spyware Terminator Spyware Terminator is an adware and spyware scanner. It can remove spyware, adware, Trojans, keyloggers, home-page hijackers, and other malware threats. The following are some of the features of Spyware Terminator: • Removes spyware: Spyware Terminator scans a computer for known threats and reports its findings. • Scheduled scans: It gives users the ability to schedule spyware scans on a regular basis to ensure a computer’s integrity. • Antivirus integration: It includes an open-source antivirus program to achieve a higher level of security. Figure 8-8 shows a screenshot from Spyware Terminator.

Tool: XoftSpySE XoftSpySE is a spyware detection, scanning, and removal tool, protecting users from unwanted spyware. The following are some of its features: • XoftSpySE completely scans PCs, including memory and registry. • It removes all spyware, unwanted toolbars, and browser hijacks. • It prevents identity theft. Figure 8-9 shows a screenshot from XoftSpySE.

Tool: Spy Sweeper Spy Sweeper detects and removes traces of spyware, including Trojans, adware, keyloggers, and system monitoring tools. It has the ability to run spyware scans automatically, prevent new malware from being installed, and prevent unauthorized system changes to browser settings, startup programs, and so on.

Tool: Spy Sweeper

Source: http://www.spywareterminator.com/features/antispyware-features.aspx. Accessed 2/2007.

Figure 8-8

Spyware Terminator scans all the files on a computer for spyware.

Source: http://www.xoftspy.co.uk. Accessed 2/2007.

Figure 8-9

XoftSpySE scans a computer’s files, memory, and registry for spyware.

8-15

8-16

Chapter 8

Source: http://www.spychecker.com/software/antispy.html. Accessed 2/2007.

Figure 8-10

This is the main screen of Spy Sweeper.

The following are some of the features of Spy Sweeper: • Real-time protection: Spy Sweeper blocks spyware threats in real time, before they can infect a user’s system. • Advanced detection and removal: Spy Sweeper’s advanced detection and removal capabilities are effective at fully removing spyware that is notorious for being difficult to eliminate. Even the most malicious spyware programs are removed in a single sweep. • Accurate risk assessment: Spy Sweeper uses a risk assessment test when detecting spyware programs to let a user know how dangerous different spyware programs are. Spy Sweeper gives the user a quick overview of each threat, what it does, and its potential danger. Figure 8-10 shows a screenshot from Spy Sweeper.

Tool: CounterSpy CounterSpy detects and removes adware and spyware. The following are some of the features of CounterSpy: • System scans: The scanning engine checks the entire computer using in-depth scans of the computer’s hard drives, memory, processes, registry, and cookies. It uses a continually updated database of thousands of known spyware signatures to provide ongoing and accurate protection. A user can scan for spyware manually or schedule times for CounterSpy to scan the computer. • FirstScan: FirstScan is CounterSpy’s scan-and-remove-on-boot technology designed specifically to detect and remove the most deeply embedded malware. CounterSpy scans the disk and cleans out malware prior to Windows startup so that hard-to-kill malware and rootkits can be exterminated. • Kernel-level active protection: The kernel is the heart of an operating system. CounterSpy’s active protection works inside the Windows kernel, watching for malware and stopping it before it has a chance to execute on a user’s system. • ThreatNet: ThreatNet provides ongoing security risk information, which is used to update the CounterSpy spyware database. ThreatNet is a revolutionary network community that connects diverse CounterSpy users so they can share and identify new applications and signatures. This information helps block new spyware. Figure 8-11 shows a screenshot of CounterSpy.

Tool: iMonitorPC

8-17

Source: http://www.sunbeltsoftware.com/documents/counterspy-user-guide.pdf. Accessed 2/2007.

Figure 8-11 CounterSpy’s main screen provides a comprehensive view of its protection.

Tool: SUPERAntiSpyware SUPERAntiSpyware scans computer systems for known spyware, adware, malware, Trojans, dialers, worms, keyloggers, hijackers, and many other types of threats. The following are some of the features of SUPERAntiSpyware: • It offers quick, complete, and custom scanning of hard drives, removable drives, memory, the registry, individual folders, and so on. • It includes excluding folders for complete customization of scanning. • It repairs broken Internet connections, desktops, registries, and more. • It offers real-time blocking of threats. • It schedules either quick, complete, or custom scans daily or weekly to ensure a user’s computer is free from harmful software. Figures 8-12 and 8-13 show screenshots from SUPERAntiSpyware.

Tool: iMonitorPC iMonitorPC monitors computer activities and Internet use by employees. It helps in discovering employee productivity and documents any computer or network abuse. It runs invisibly and records the following types of user activity: • Programs used • Web sites visited • Chat history • Social network usage

8-18

Chapter 8

Source: http://www.superantispyware.com/index.html. Accessed 2/2007.

Figure 8-12

This shows the main screen for SUPERAntiSpyware.

Source: http://www.superantispyware.com/index.html. Accessed 2/2007.

Figure 8-13 SUPERAntiSpyware displays a report of the threats it has found, allowing users to remove or quarantine those files.

Guidelines for Writing Employee-Monitoring Policies

8-19

Source: http://www.imonitorpc.com/IMonitorPCEnterprise.aspx. Accessed 2/2007.

Figure 8-14 iMonitorPC performs screen captures so an administrator can see what employees are doing.

iMonitorPC records the following types of usage information: • Screen captures (Figure 8-14) • Detailed activity reports • Summary reports iMonitorPC also includes the following: • Web site blocking • Program usage limits • Chat user blocking • User alerts • Advanced filtering

Guidelines for Writing Employee-Monitoring Policies Because of security reasons, organizations often have to monitor employees. Management should maintain policies concerning employee monitoring. The following are some guidelines for writing employee-monitoring policies: • Make sure employees are aware of what exactly is being monitored: It is essential that employees are aware of what activities are being monitored. Employee-monitoring policies must specify all activities that are monitored. Employees must be clear if monitoring occurs only if the organization suspects a problem. • Employees should be briefed on an organization’s policies and procedures: New employees should be told about the rules, regulations, policies, and procedures of the organization. Any questions should be answered. • Employees should be made aware of the consequences of policy violations: Policies should provide detailed information of punishment if an employee violates the rules and regulations of the organization.

8-20

Chapter 8

• Be specific and the policy should be applicable to each and every employee: The policy should be specific and should relate to every employee in the organization, irrespective of the employee’s position. An organization should take action if any employee violates the rules. • Terms that are specific should be bold, underlined, or italicized: Specific and technical terms that let the employee understand the policy clearly should be brought to notice by making them bold, underlined, or italicized. • Apply provisions that allow for updates to the policy: An organization should make provisions for updating policies. • Policies should adhere to local laws: Policies should relate to local laws, as an organization can involve law enforcement when an employee violates certain rules that are also laws.

Chapter Summary ■

The term corporate espionage is used to describe espionage conducted for commercial purposes on companies and governments, and to determine the activities of competitors.

■

Personal relations, disgruntled employees, and easy money are the main motives behind corporate spying.

■

The major techniques used for corporate spying are hacking, social engineering, dumpster diving, and phone eavesdropping.

■

Steps to prevent corporate espionage are understanding and prioritizing critical assets, defining acceptable level of loss, controlling access, baiting, detecting moles, profiling, monitoring, and analyzing signatures.

■

Netspionage is defined as network-enabled espionage in which knowledge and sensitive proprietary information are stored, transmitted, and obtained via networks and computer systems.

Review Questions 1. What are the reasons behind corporate espionage? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 2. What type of information do corporate spies look for? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 3. What are the different techniques of spying? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 4. What are the techniques for securing the confidential data of a company from spies? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 5. What are the steps to prevent corporate espionage? ___________________________________________________________________________________________ ___________________________________________________________________________________________

Hands-On Projects

8-21

6. How can you investigate corporate espionage cases? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 7. What is netspionage? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 8. Briefly explain the guidelines that organizations should follow when writing employee-monitoring policies. ___________________________________________________________________________________________ ___________________________________________________________________________________________

Hands-On Projects 1. Perform the following steps: ■

Download and install Nitrous Anti Spy from www.nitrousonline.com/antispy.html.

■

Explore the various options.

2. Perform the following steps: ■

Navigate to Chapter 8 of the Student Resource Center.

■

Install and launch SpyBuddy.

■

Click on Text/Images Sent to Clipboard (Figure 8-15).

Figure 8-15 SpyBuddy shows the text and images that a user has copied to the clipboard.

8-22

Chapter 8

■

Click on Documents and Files Accessed (Figure 8-16).

Figure 8-16 SpyBuddy shows the documents and files that a user has accessed.

■

Click on Windows Launched (Figure 8-17).

Figure 8-17

SpyBuddy shows the windows that a user has launched.

3. Perform the following steps: ■

Navigate to Chapter 8 of the Student Resource Center.

■

Install and launch Activity Monitor.

■

Explore the various options.

Chapter

9

Investigating Trademark and Copyright Infringement

Objectives After completing this chapter, you should be able to: • • • • • • • • • • • •

Understand trademarks and their characteristics Understand service marks and trade dress Recognize and investigate trademark infringement Understand copyright Investigate copyright status Understand how copyrights are enforced Understand plagiarism Use plagiarism detection tools Understand patent infringement Understand domain name infringement Investigate intellectual property theft Understand digital rights management

Key Terms Reliance party an individual or business that used a work when it was in the public domain, prior to the Uruguay Round Agreements Act

Introduction to Investigating Trademark and Copyright Infringement This chapter discusses copyrights, trademarks, and patents. It covers what constitutes infringement, and how that infringement can be investigated. For reference, the texts of some international trademark laws are included.

9-1

9-2

Chapter 9

Trademarks According to the United States Patent and Trademark Office (USPTO), “A trademark is a word, phrase, symbol or design, or a combination of words, phrases, symbols or designs, which identifies and distinguishes the source of the goods of one party from those of others.” Brand names, symbols, slogans, designs, words, smells, colors, or a combination of any of these that distinguishes a particular product or service from others of the same trade classify as trademarks. There are three types of trademarks, as defined by the USPTO: 1. Service mark: “A service mark is any word, name, symbol, device, or any combination, used, or intended to be used, in commerce, to identify and distinguish the services of one provider from services provided by others, and to indicate the source of the services.” Some consider service marks to be separate from trademarks. 2. Collective mark: “A collective mark is a trademark or service mark used or intended to be used, in commerce, by the members of a cooperative, an association, or other collective group or organization, including a mark, which indicates membership in a union, an association, or other organization.” 3. Certification mark: “Certification mark is any word, name, symbol, device, or any combination, used, or intended to be used, in commerce with the owner’s permission by someone other than its owner, to certify regional or other geographic origin, material, mode of manufacture, quality, accuracy, or other characteristics of someone’s goods or services, or that the work or labor on the goods or services was performed by members of a union or other organization.”

Trademark Eligibility and Benefits of Registering It An individual or business unit intending to use a unique identifier to categorize its goods or services can register that identifier as a trademark. The trademark should be unique and not misleading. To own a trademark, the individual or business unit must file a trademark application form at the USPTO. The application form must include the following to be accepted by the USPTO: • • • • •

Applicant’s name Applicant’s address for correspondence A depiction of the mark A list of the goods or services provided The application filing fee

Registering the trademark provides several benefits, including the following: • • • •

Protection of an organization’s name and logo Exclusive rights of the mark and protection against trademark infringement More visibility of the product versus other products in the same trade Inclusion in the trademark search database, which helps to discourage other applicants from filing a similar kind of trademark • The ability to, in the event of trademark infringement, ask the infringer to pay for damages and the attorneys’ fees that the plaintiff incurred while filing the lawsuit • A base for filing the registration for that particular trademark in a foreign country

Service Mark and Trade Dress There is a thin line of difference between a trademark and a service mark, so some consider them to be in the same category. A trademark differentiates products of the same trade, while a service mark differentiates services of the same trade. The symbol SM is for an unregistered service mark, and the symbol TM represents an unregistered trademark. Trade dress is the distinctive packaging of a product that differentiates it from other products of the same trade. Color, pattern, shape, design, arrangement of letters and words, packaging style, and graphical presentation all constitute trade dress. Previously, trade dress referred to the way in which a product was packaged to be launched in a market, but now even the product design is an element of trade dress. Elements of trade dress do not affect the way in which the product is used. Federal law for trademark also applies to trade dress. There is no distinction between trade dress and trademark; the Lanham Act, also known as the Trademark Act of 1946, does not provide any distinction between the two.

Trademark Infringement

9-3

Trademark Infringement An infringement is the encroachment on another’s right or privilege. In the legal field, this term is often used when referring to intellectual property rights, such as patents, copyrights, and trademarks. A party that owns the rights to a particular trademark can sue other parties for trademark infringement based on the standard likelihood of confusion. The Trademark Act of 1946 section 1114 and 1125 specify trademark infringement. The full text of these sections follows: TITLE VI REMEDIES § 32 (15 U.S.C. § 1114). Remedies; infringement; innocent infringers (1) Any person who shall, without the consent of the registrant— a) Use in commerce any reproduction, counterfeit, copy, or colorable imitation of a registered mark in connection with the sale, offering for sale, distribution, or advertising of any goods or services on or in connection with which such use is likely to cause confusion, or to cause mistake, or to deceive; or b) Reproduce, counterfeit, copy or colorably imitate a registered mark and apply such reproduction, counterfeit, copy or colorable imitation to labels, signs, prints, packages, wrappers, receptacles or advertisements intended to be used in commerce upon or in connection with the sale, offering for sale, distribution, or advertising of goods or services on or in connection with which such use is likely to cause confusion, or to cause mistake, or to deceive, shall be liable in a civil action by the registrant for the remedies hereinafter provided. Under subsection (b) hereof, the registrant shall not be entitled to recover profits or damages unless the acts have been committed with knowledge that such imitation is intended to be used to cause confusion, or to cause mistake, or to deceive. As used in this paragraph, the term “any person” includes the United States, all agencies and instrumentalities thereof, and all individuals, firms, corporations, or other persons acting for the United States and with the authorization and consent of the United States, and any State, any instrumentality of a State, and any officer or employee of a State or instrumentality of a State acting in his or her official capacity. The United States, all agencies and instrumentalities thereof, and all individuals, firms, corporations, other persons acting for the United States and with the authorization and consent of the United States, and any State, and any such instrumentality, officer, or employee, shall be subject to the provisions of this Act in the same manner and to the same extent as any nongovernmental entity. (2) Notwithstanding any other provision of this Act, the remedies given to the owner of a right infringed under this Act or to a person bringing an action under section 43(a) or (d) shall be limited as follows: a) Where an infringer or violator is engaged solely in the business of printing the mark or violating matter for others and establishes that he or she was an innocent infringer or innocent violator, the owner of the right infringed or person bringing the action under section 43(a) shall be entitled as against such infringer or violator only to an injunction against future printing. b) Where the infringement or violation complained of is contained in or is part of paid advertising matter in a newspaper, magazine, or other similar periodical or in an electronic communication as defined in section 2510(12) of title 18, United States Code, the remedies of the owner of the right infringed or person bringing the action under section 43(a) as against the publisher or distributor of such newspaper, magazine, or other similar periodical or electronic communication shall be limited to an injunction against the presentation of such advertising matter in future issues of such newspapers, magazines, or other similar periodicals or in future transmissions of such electronic communications. The limitations of this subparagraph shall apply only to innocent infringers and innocent violators. c) Injunctive relief shall not be available to the owner of the right infringed or person bringing the action under section 43(a) with respect to an issue of a newspaper, magazine, or other similar periodical or an electronic communication containing infringing matter or violating

9-4

Chapter 9

matter where restraining the dissemination of such infringing matter or violating matter in any particular issue of such periodical or in an electronic communication would delay the delivery of such issue or transmission of such electronic communication after the regular time for such delivery or transmission, and such delay would be due to the method by which publication and distribution of such periodical or transmission of such electronic communication is customarily conducted in accordance with sound business practice, and not due to any method or device adopted to evade this section or to prevent or delay the issuance of an injunction or restraining order with respect to such infringing matter or violating matter. d)(i)(I) A domain name registrar, a domain name registry, or other domain name registration authority that takes any action described under clause (ii) affecting a domain name shall not be liable for monetary relief or, except as provided in subclause (II), for injunctive relief, to any person for such action, regardless of whether the domain name is finally determined to infringe or dilute the mark. (II) A domain name registrar, domain name registry, or other domain name registration authority described in subclause (I) may be subject to injunctive relief only if such registrar, registry, or other registration authority has— (aa) not expeditiously deposited with a court, in which an action has been filed regarding the disposition of the domain name, documents sufficient for the court to establish the court’s control and authority regarding the disposition of the registration and use of the domain name; (bb) transferred, suspended, or otherwise modified the domain name during the pendency of the action, except upon order of the court; or (cc) willfully failed to comply with any such court order. (ii) An action referred to under clause (i)(I) is any action of refusing to register, removing from registration, transferring, temporarily disabling, or permanently canceling a domain name— (I) In compliance with a court order under section 43(d); or (II) In the implementation of a reasonable policy by such registrar, registry, or authority prohibiting the registration of a domain name that is identical to, confusingly similar to, or dilutive of another’s mark. (iii) A domain name registrar, a domain name registry, or other domain name registration authority shall not be liable for damages under this section for the registration or maintenance of a domain name for another absent a showing of bad faith intent to profit from such registration or maintenance of the domain name. (iv) If a registrar, registry, or other registration authority takes an action described under clause (ii) based on a knowing and material misrepresentation by any other person that a domain name is identical to, confusingly similar to, or dilutive of a mark, the person making the knowing and material misrepresentation shall be liable for any damages, including costs and attorney’s fees, incurred by the domain name registrant as a result of such action. The court may also grant injunctive relief to the domain name registrant, including the reactivation of the domain name or the transfer of the domain name to the domain name registrant. (v) A domain name registrant whose domain name has been suspended, disabled, or transferred under a policy described under clause (ii)(II) may, upon notice to the mark owner, file a civil action to establish that the registration or use of the domain name by such registrant is not unlawful under this Act. The court may grant injunctive relief to the domain name registrant, including the reactivation of the domain name or transfer of the domain name to the domain name registrant. e) As used in this paragraph—(i) the term “violator” means a person who violates section 43(a); and (ii) The term “violating matter” means matter that is the subject of a violation under section 43(a). (Amended Oct. 9, 1962, 76 Stat. 773; Nov. 16, 1988, 102 Stat. 3943; Oct. 27, 1992, 106 Stat. 3567; Oct. 30, 1998, 112 Stat. 3069; Aug. 5, 1999, 113 Stat. 218; Nov. 29, 1999, 113 Stat. 1501A-549.)

Trademark Infringement

TITLE VIII FALSE DESIGNATIONS OF ORIGIN, FALSE DESCRIPTIONS, AND DILUTION FORBIDDEN § 43 (15 U.S.C. § 1125). False designations of origin; false description or representation a)(1) Any person who, on or in connection with any goods or services, or any container for goods, uses in commerce any word, term, name, symbol, or device, or any combination thereof, or any false designation of origin, false or misleading description of fact, or false or misleading representation of fact, which— (A) Is likely to cause confusion, or to cause mistake, or to deceive as to the affiliation, connection, or association of such person with another person, or as to the origin, sponsorship, or approval of his or her goods, services, or commercial activities by another person, or (B) In commercial advertising or promotion, misrepresents the nature, characteristics, qualities, or geographic origin of his or her or another person’s goods, services, or commercial activities, Shall be liable in a civil action by any person who believes that he or she is or is likely to be damaged by such act (2) As used in this subsection, the term “any person” includes any State, instrumentality of a State or employee of a State or instrumentality of a State acting in his or her official capacity. Any State, and any such instrumentality, officer, or employee, shall be subject to the provisions of this Act in the same manner and to the same extent as any nongovernmental entity. (3) In a civil action for trade dress infringement under this Act for trade dress not registered on the principal register, the person who asserts trade dress protection has the burden of proving that the matter sought to be protected is not functional. b) Any goods marked or labeled in contravention of the provisions of this section shall not be imported into the United States or admitted to entry at any customhouse of the United States. The owner, importer, or consignee of goods refused entry at any customhouse under this section may have any recourse by protest or appeal that is given under the customs revenue laws or may have the remedy given by this Act in cases involving goods refused entry or seized. c)(1) T.he owner of a famous mark shall be entitled, subject to the principles of equity and upon such terms as the court deems reasonable, to an injunction against another person’s commercial use in commerce of a mark or trade name, if such use begins after the mark has become famous and causes dilution of the distinctive quality of the mark, and to obtain such other relief as is provided in this subsection. In determining whether a mark is distinctive and famous, a court may consider factors such as, but not limited to— (A) The degree of inherent or acquired distinctiveness of the mark; (B) The duration and extent of use of the mark in connection with the goods or services with which the mark is used; (C) The duration and extent of advertising and publicity of the mark; (D) The geographical extent of the trading area in which the mark is used; (E) The channels of trade for the goods or services with which the mark is used; (F) The degree of recognition of the mark in the trading areas and channels of trade used by the mark’s owner and the person against whom the injunction is sought; (G) The nature and extent of use of the same or similar marks by third parties; and (H) Whether the mark was registered under the Act of March 3, 1881, or the Act of February 20, 1905, or on the principal register. (2) In an action brought under this subsection, the owner of the famous mark shall be entitled only to injunctive relief as set forth in section 34 unless the person against whom the injunction is sought willfully intended to trade on the owner’s reputation or to cause dilution of the famous mark. If such willful intent is proven, the owner of the famous mark shall also be entitled to the remedies set forth in sections 35(a) and 36, subject to the discretion of the court and the principles of equity. (3) The ownership by a person of a valid registration under the Act of March 3, 1881, or the Act of February 20, 1905, or on the principal register shall be a complete bar to an action against

9-5

9-6

Chapter 9

that person, with respect to the mark, that is brought by another person under the common law or a statute of a State and that seeks to prevent dilution of the distinctiveness of a mark, label or form or advertisement. (4) The following shall not be actionable under this section: (A) Fair use of a famous mark by another person in comparative commercial advertising or promotion to identify the competing goods or services of the owner of the famous mark. (B) Noncommercial use of a mark. (C) All forms of news reporting and news commentary. (D)(1)(A) A person shall be liable in a civil action by the owner of a mark, including a personal name which is protected as a mark under this section, if, without regard to the goods or services of the parties, that person— (i) Has a bad faith intent to profit from that mark, including a personal name which is protected as a mark under this section; and (ii) Registers, traffics in, or uses a domain name that— (I) In the case of a mark that is distinctive at the time of registration of the domain name, is identical or confusingly similar to that mark; (II) In the case of a famous mark that is famous at the time of registration of the domain name, is identical or confusingly similar to or dilutive of that mark; or (III) Is a trademark, word, or name protected by reason of section 706 of title 18, United States Code, or section 220506 of title 36, United States Code. (B) (i) In determining whether a person has a bad faith intent described under subparagraph (A), a court may consider factors such as, but not limited to— (I) The trademark or other intellectual property rights of the person, if any, in the domain name; (II) The extent to which the domain name consists of the legal name of the person or a name that is otherwise commonly used to identify that person; (III) The person’s prior use, if any, of the domain name in connection with the bona fide offering of any goods or services; (IV) The person’s bona fide noncommercial or fair use of the mark in a site accessible under the domain name; (V) The person’s intent to divert consumers from the mark owner’s online location to a site accessible under the domain name that could harm the goodwill represented by the mark, either for commercial gain or with the intent to tarnish or disparage the mark, by creating a likelihood of confusion as to the source, sponsorship, affiliation, or endorsement of the site; (VI) The person’s offer to transfer, sell, or otherwise assign the domain name to the mark owner or any third party for financial gain without having used, or having an intent to use, the domain name in the bona fide offering of any goods or services, or the person’s prior conduct indicating a pattern of such conduct; (VII) The person’s provision of material and misleading false contact information when applying for the registration of the domain name, the person’s intentional failure to maintain accurate contact information, or the person’s prior conduct indicating a pattern of such conduct; (VIII) The person’s registration or acquisition of multiple domain names which the person knows are identical or confusingly similar to marks of others that are distinctive at the time of registration of such domain names, or dilutive of famous marks of others that are famous at the time of registration of such domain names, without regard to the goods or services of the parties; and

Trademark Infringement

(IX) The extent to which the mark incorporated in the person’s domain name registration is or is not distinctive and famous within the meaning of subsection (c)(1) of section 43. (ii) Bad faith intent described under subparagraph (A) shall not be found in any case in which the court determines that the person believed and had reasonable grounds to believe that the use of the domain name was a fair use or otherwise lawful. (C) In any civil action involving the registration, trafficking, or use of a domain name under this paragraph, a court may order the forfeiture or cancellation of the domain name or the transfer of the domain name to the owner of the mark. (D) A person shall be liable for using a domain name under subparagraph (A) only if that person is the domain name registrant or that registrant’s authorized licensee. (E) As used in this paragraph, the term “traffics in” refers to transactions that include, but are not limited to, sales, purchases, loans, pledges, licenses, exchanges of currency, and any other transfer for consideration or receipt in exchange for consideration. (2)(A) The owner of a mark may file an in rem civil action against a domain name in the judicial district in which the domain name registrar, domain name registry, or other domain name authority that registered or assigned the domain name is located if— (i) The domain name violates any right of the owner of a mark registered in the Patent and Trademark Office, or protected under subsection (a) or (c); and (ii) The court finds that the owner— (I) Is not able to obtain in personam jurisdiction over a person who would have been a defendant in a civil action under paragraph (1); or (II) Through due diligence was not able to find a person who would have been a defendant in a civil action under paragraph (1) by— (aa) sending a notice of the alleged violation and intent to proceed under this paragraph to the registrant of the domain name at the postal and e-mail address provided by the registrant to the registrar; and (bb) publishing notice of the action as the court may direct promptly after filing the action. (B) The actions under subparagraph (A)(ii) shall constitute service of process. (C) In an in rem action under this paragraph, a domain name shall be deemed to have its sites in the judicial district in which— (i) The domain name registrar, registry, or other domain name authority that registered or assigned the domain name is located; or (ii) Documents sufficient to establish control and authority regarding the disposition of the registration and use of the domain name are deposited with the court. (D) (i) The remedies in an in rem action under this paragraph shall be limited to a court order for the forfeiture or cancellation of the domain name or the transfer of the domain name to the owner of the mark. Upon receipt of written notification of a filed, stamped copy of a complaint filed by the owner of a mark in a United States district court under this paragraph, the domain name registrar, domain name registry, or other domain name authority shall— (I) Expeditiously deposit with the court documents sufficient to establish the court’s control and authority regarding the disposition of the registration and use of the domain name to the court; and (II) Not transfer, suspend, or otherwise modify the domain name during the pendency of the action, except upon order of the court. (ii) The domain name registrar or registry or other domain name authority shall not be liable for injunctive or monetary relief under this paragraph except in the case of bad faith or reckless disregard, which includes a willful failure to comply with any such court order.

9-7

9-8

Chapter 9

(3) The civil action established under paragraph (1) and the in rem action established under paragraph (2), and any remedy available under either such action, shall be in addition to any other civil action or remedy otherwise applicable. (4) The in rem jurisdiction established under paragraph (2) shall be in addition to any other jurisdiction that otherwise exists, whether in rem or in personam. (Amended Nov. 16, 1988, 102 Stat. 3946; Oct. 27, 1992, 106 Stat. 3567; Jan. 16, 1996, 109 Stat. 985; Aug. 5, 1999, 113 Stat. 218; Nov. 29, 1999, 113 Stat. 1501A-545)

Monitoring Trademark Infringements Trademark infringement is a threat to any successful product or brand. It not only affects the direct revenue of the branded product, but it also defames the product by confusing the customer with products of inferior quality. It is necessary for the holder of a trademark to monitor infringements, following these guidelines: • Check whether the infringement has been done by a distributor, employee, or customer. • Check any third party who is involved in the infringement process. • Ask for government authorities to identify a problem in third-party trademark application filings and domain name registrations. • Stay up to date with news, articles, and consumers’ comments through which infringement can be prevented in its initial stages. • Analyze infringement with the use of search engines. • Make use of trademark infringement monitoring services such as CyberAlert and AdGooroo for detailed monitoring. For example, say an organization trademarks a successful product called “WEED EATER” and another organization trademarks a different, inferior product called “weedeater.” A consumer may wish to buy a “WEED EATER,” but could end up with a “weedeater” by mistake, costing the original organization a sale and tarnishing its name with a product of lesser quality.

Key Considerations Before Investigating Trademark Infringements Before investigating trademark infringements, an investigator must do the following: • Check if the trademark owner has registered or applied for registration in the country where the infringement has occurred. • • • •

Check if the country is a member of the Paris Convention or the Madrid Protocol. Check the laws addressing this kind of infringement. Look for availability of adequate and strong enforcement mechanisms. Check whether the trademark is in use in the relevant country or is vulnerable to cancellation.

Steps for Investigating Trademark Infringements When investigating illegal trademark infringement, follow these steps: 1. Check the type of infringement. 2. Investigate the infringement. a. Check if the trademark owner has the necessary rights within the scope of the infringement. b. If the owner has prior rights, seek a settlement or pursue court proceedings. c. Obtain photographs and video footage outside the infringement location, i.e., property, area, buildings, signs, and so on. d. Obtain any available literature, brochures, business cards, and printouts from any sales software available. e. Document any promotional programs that are in use. f. Maintain a record of conversations with the business owner or employees. g. Do background research on the subject’s entity—local, county, state, and federal business registrations and licenses. h. Obtain video footage on location using hidden cameras.

Copyright

9-9

3. Search for any article or advertisement related to the issue that was published in a newspaper or magazine. 4. Obtain civil, criminal, and family background on the business or its owners. 5. Document the intellectual property of the business or owner. 6. Investigate the history of the registration and license for filing in court. 7. Check conversations with neighboring businesses or residents. 8. Document pending changes that are noted during the investigation. 9. Document and investigate new locations. 10. Keep an updated record of changes in promotional programs to present as evidence in court. 11. Monitor changes after the proceedings in court.

Copyright According to the USPTO, “Copyright is a form of protection provided to the authors of ‘original works of authorship’ including literary, dramatic, musical, artistic, and certain other intellectual works, both published and unpublished.” The 1976 Copyright Act empowers the owner of a copyright to reproduce and distribute the copyrighted work as well as derivatives of the work. It also gives the owner of the copyright the right to showcase the copyrighted work in public, sell it, and give rights related to it to others. The owner is also allowed to transfer the copyrighted work to a publication house and charge royalties. A copyright notice for visually perceptible copies should have the word “Copyright” followed by the symbol ©, the published date, and the name of the owner. Works published before March 1989 require a valid copyright notice in order to be protected under the laws governing copyright. Works published after March 1, 1989, do not need to have a written copyright notice to be protected by copyright law, but it is still advisable.

Investigating Copyright Status The following are the three basic ways by which an investigator can investigate the copyright status of a particular work: 1. Examine the copy of the work to find elements that need to be included in the copyright notice. Because works published after March 1, 1989, do not need to have a copyright notice along with the copyrighted work, the investigator has to do extensive research by using tools such as search engines to check the status of the copyrighted work. 2. Search the database of the U.S. Copyright Office (http://www.copyright.gov/records). This search method is recommended for users who search the database only occasionally. For an advanced search, the investigator should use the Library of Congress Information System (LOCIS). The LOCIS usage guide should be read before connecting to LOCIS. 3. Approach the U.S. Copyright Office to do a search for the requested category. After the request is made for a copyright search, the U.S. copyright officials will search the records for a fee of $75 per hour. A typewritten or oral report will be sent at the investigator’s request. The status changes made under the Copyright Act of 1976, the Berne Convention Implementation Act of 1988, the Copyright Renewal Act of 1992, and the Sonny Bono Copyright Term Extension Act of 1998 must be considered. It is important that the investigator has a clear understanding of these laws.

Tool: LOCIS The Library of Congress Information System (LOCIS) is an online utility that helps an investigator search for copyright records. LOCIS runs on a command prompt. There is a link on the Library of Congress’s Web page to connect to LOCIS. Figure 9-1 shows a screenshot from LOCIS. An investigator should follow the on-screen instructions to search the LOCIS database. Typing help at the command prompt shows the help screen at any point during the session. Information related to copyright and federal legislation can be obtained from the database.

How Long Does a Copyright Last? The duration of a copyright is different for joint works, anonymous works, works under pseudonyms, and worksfor-hire. In general, copyrights for works that are published after 1977 are valid for the life span of the author plus another 70 years. Works published before 1923 in the United States are in the public domain. Copyrights for works published between 1923 and 1977 have a validity of 95 years from the date of first publication.

9-10

Chapter 9

Figure 9-1

This is the LOCIS interface using HyperTerminal.

Works done by two or more authors are called joint works. Validity of the copyright for these works is until the death of the last surviving author of that particular work plus the next 70 years. The copyright for anonymous, pseudonymous, or made-for-hire works lasts for the shorter of a period of 95 years from the year when the work was published or for a period of 120 years from the year when the work was created. Copyrights for works-for-hire can be renewed and extended for a term of 67 years by owner request.

U.S. Copyright Office Article 1, Section 8 of the U.S. Constitution empowers Congress “to promote the progress of science and useful arts, by securing for limited times to authors and inventors the exclusive right to their respective writings and discoveries.” The objectives of the U.S. Copyright Office are as follows: • To govern copyright law • To create and maintain the public record • • • •

To impart technical support to Congress To offer information service to the public To serve as a resource to international and domestic communities To provide support to the Library of Congress

How Are Copyrights Enforced? President Bill Clinton signed the Uruguay Round Agreements Act (URAA) on December 8, 1994. This agreement created the Notice of Intent to Enforce (NIE). According to URAA, the owner of a restored work should notify any reliance parties if there is a plan to enforce copyrights for the particular work. A reliance party is an individual or business who used the work when the status of the work was in the public domain, prior to the URAA agreement. The URAA directs the owner of a restored work to confront the reliance party either directly or by providing a constructive notice via filing a Notice of Intent to Enforce with the U.S. Copyright Office. A lawsuit can be filed against anyone who has violated the rights of the copyright owner. Infringers who violate the fair use doctrine and try to commercialize the work of copyrighted owners or portray it as their own will often have to face a lawsuit from the owners of the copyrighted work.

Copyright

9-11

In this case, the copyright owner can do the following: • Issue orders to prevent escalation of copyrights • Ask for compensation from the infringer for the damage already done • Ask the infringer to pay attorneys’ fees

Plagiarism Plagiarism is when someone takes someone else’s words or ideas and presents them as his or her own. Plagiarism can prove costly, especially to students. Copying or even paraphrasing original ideas without quoting the source is an act of plagiarism. Examining the writing style, layout, formatting style, and references can help determine if students have plagiarized their work.

Paper Mills Paper mills are Web sites that provide students with research works, essays, and so on. Some are advertiser supported and available for free. The following are a few paper mills: • • • •

http://www.cheathouse.com http://www.essaysonfile.com http://www.gradesaver.com http://www.mightystudents.com

Types of Plagiarism Plagiarism is categorized into various types depending upon its nature: • Sources not cited • Ghostwriting: taking the entire work directly from one source, without altering key words or phrases • Poor masking: changing the appearance of information by altering key words or phrases • Photocopying: copying a few portions of information directly from one source without any alteration • Potlucking: using phrases from many sources, tweaking the sentences so as to fit them together but retaining most of the original phrasing • Laziness: rewording or paraphrasing without concentrating on original work • Self-plagiarizing: copying information from the creator’s previous work • Sources cited • Omitting or misattributing source: not citing, or misguiding the user to the resource • Perfect paraphrasing: citing the source and avoiding quotation marks for directly copied information

Steps for Plagiarism Prevention To prevent plagiarism, follow these steps: 1. Know in detail the types of plagiarism. 2. Understand facts and myths about plagiarism. 3. Cite the source, if the information is directly taken from it. 4. Quote the information if it cannot be reworded. 5. Learn to paraphrase, as it avoids plagiarism to an extent. 6. Be aware of detection tools. 7. Be aware of policies and procedures. 8. Be aware of legal penalties.

Plagiarism Detection Factors An investigator should look for the following when detecting plagiarism: • Change of vocabulary: The vocabulary used by the author in one portion of the text is inconsistent with the rest of the text.

9-12

Chapter 9

• Incoherent text: The text is not in the proper style and appears to be written by many people. • Punctuation: The punctuation marks used in one text are the same as in another text. It is not likely for two different authors to use the same punctuation marks while writing the text. • Dependence on certain words and phrases: Certain words and phrases are used by one author as well as by another author. Different authors tend to have different word preferences. • Amount of similarity between texts: Two texts written by two different authors share large amounts of similar text. • Long sequences of common text: Long sequences of common words or phrases are in the text. • Similarity in the order of text: Two texts have the same order of words and phrases. • Frequency of words: Two texts contain the same frequency of words. • Common spelling mistakes: An independent author makes the same spelling mistakes repetitively as another author. • Distribution of words: The distribution of word usage by an independent author appears in the same fashion throughout the document as another’s work. • Syntactic structure of the text: Two texts written by different authors have similar syntactic structure. Different authors often use different syntactic rules. • Preference for the use of long or short sentences: If a sentence is long and shows no meaning in the text, it is possible that the author has combined sentences copied from another text. • Readability of written text: The same readability is found in the works of two different authors. • Inadequate references: References appear only in the text, but not in the bibliography.

Plagiarism Detection Tools The following are the three categories of plagiarism detection tools: 1. Tools to detect plagiarism in text, such as Sumbit.ac.uk and CopyCatch, are helpful in checking plagiarism in works submitted in Microsoft Word, Corel WordPerfect, and text formats. 2. Tools to detect plagiarism in source code, such as JPlag and CodeMatch, help in finding similar source code from multiple sets. 3. Tools such as BOSS from Warwick University’s computer science department assist in the process of data collection.

Tool: Turnitin Turnitin is an online plagiarism detection tool primarily for educators and students. Turnitin detects plagiarism by comparing the submitted work to pages available on the Internet and in its database. Figure 9-2 shows a screenshot from Turnitin. The following are the key features of Turnitin: • Plagiarism prevention: It helps identify the plagiarized work of students and also acts as a deterrent, stopping plagiarism before it starts. • Peer review: It helps students review each other’s work. • Grademark: This tool helps instructors, without much hassle, in assessing works submitted by students. Instructors can add comments to the submitted work without altering the formatting of the document. • Gradebook: It is similar to a paper gradebook, where the instructor can manage assignments and grade students in a more organized manner. • Digital portfolio: It is an online student record book, helping to track student records for academic purposes or for placements.

Tool: CopyCatch CopyCatch supports various formats such as Rich Text Format (RTF), Microsoft Word documents, and text. After checking documents for plagiarism, this utility highlights the changes on the screen and saves them in RTF format. It includes Web search comparison, zip archive submission, and course/module filtering. CopyCatch is shown in Figure 9-3.

Tool: Copy Protection System (COPS) The Copy Protection System (COPS) is an experimental working prototype of a copy detection system that can be used in a digital library. The COPS part of the project is to

Copyright

9-13

Figure 9-2 The Turnitin originality report shows the similarities between documents.

Figure 9-3

CopyCatch compares sentences between documents.

detect exact or partial copies of documents in the library in TeX, DVI, and Troff formats. The system looks for documents with significant overlap as well as exact copies. These documents are first converted into ASCII format. They are then divided into sentences called units, and these sentences are further grouped together to form a series of sentences called chunks. These sentences are stored in a registration server that is simply a large hash table using a standard hashing algorithm. These chunks are compared with the other documents to check whether there is overlapping. If the documents share a preset number of sentences, then a violation is flagged. Figure 9-4 shows the COPS architecture.

9-14

Chapter 9

Test to ASCII

DVI to ASCII

Troff to ASCII

Sentence Identification and Hashing

Query Processing

Document Processing

Database

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 9-4

COPS compares large amounts of documents for similarities.

Tool: Stanford Copy Analysis Mechanism (SCAM) The Stanford Copy Analysis Mechanism (SCAM) is another system designed for detecting plagiarism, copies, extracts, and strongly similar documents in digital libraries. The main difference between SCAM and COPS is that SCAM is a word-based scheme, whereas COPS is sentence-based. The problem with simply comparing sentences is that partial sentence overlaps are not detected. Figure 9-5 shows the functionality of SCAM. The documents are divided into words (units) and these are grouped to form chunks. The chunks are inserted into the repository in an inverted index structure and are used to compare with new document arrivals. SCAM uses words as chunks for comparison, allowing the system to detect partial sentence overlap. SCAM uses a derivative of the vector-space model to measure similarity between documents. This is a popular information retrieval (IR) technique and operates by storing the normalized frequency of words within the document as a vector. The vectors are then compared for similarity, using a measure such as the vector dot product or cosine-similarity measure and a resulting value. If this measure exceeds a predefined threshold, the document is flagged. Tool: CHECK CHECK maintains a database for registered documents in order to compare them with the new document. With the help of the IR system, CHECK filters out the probable plagiarism candidates. Later, the IR process is applied to sections, subsections, paragraphs, and finally individual sentences. Comparison of two documents is mainly based on keywords because they identify the semantic meaning of the document. Computer programs are well structured and preserve the parse tree of the original program, even though changes were made to them. Finding plagiarism in a document is harder because the document protects the semantics of the original; however, it makes more changes when compared to a computer program. CHECK merges the weighted words into the parse tree to capture a better representation that is resistant to simple document modifications. It identifies the LaTeX documents at the time of writing. CHECK works in the following ways: • Document recognition: The LaTeX recognizer parses the documents and creates a new document tree. • Keyword extraction: IR techniques are used to extract the words. These words explain the semantics of the document. These words are classified into the following two classes: • Open-class words consist of nouns, verbs, adjectives, and adverbs. • Closed-class words consist of prepositions, pronouns, conjunctions, and interjections. • Generating structural characteristics: For each and every document, a structural characteristic (SC) must be generated. It looks like a document that is mixed with an extracted set of keywords.

Copyright

9-15

Web Server Postscript, HTML, Word

Mail Server

Bulk Loader

Chunker

Parser

Copy Detection

Mailing Lists, Web Pages Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 9-5

SCAM compares words to other documents in a database.

Figure 9-6

JPlag compares code files and displays results graphically.

Tool: JPlag JPlag detects software plagiarism by identifying the similarities between multiple sets of code files. It does not compare the bytes of the text, but it compares the programming language syntax and program structure in order to distinguish the similarities between plagiarized files. JPlag supports programming languages like Java, C, and C++. It also supports Scheme and natural language texts. Results are displayed in a graphical interface, shown in Figure 9-6. Tool: VAST The Visual Analysis of Similarity Tool (VAST) offers an interactive visualization of two different documents and highlights the areas that are plagiarized. It is used to investigate the extent and similarity of the text that is detected by tools like PRAISE (mentioned later). In Figure 9-7, the upper document was downloaded from the Web and the lower document was an assignment submitted by a computing student. Once two documents have been pasted, the type of image can be selected, and pressing the Create Image button will start the generation of the image. The default image type is unsequenced, which ignores the sequence in which words common to both documents appear. The alternative is sequenced, which includes this information; however, the sequenced option takes significantly longer to prepare.

9-16

Chapter 9

Figure 9-7

VAST displays documents graphically, highlighting similarities.

Two totally identical documents would generate a square image with a single dark band along the prime upper-left, lower-right diagonal. Figure 9-7 indicates that the start of both documents is similar; following that, there is some original material in the lower document. The two areas mirrored across the diagonal suggest some simple rearrangement of the Web upper document in the lower document, following which there is a long similar section. The document ends with some original material in the lower document before another small similar section. Projecting the dark areas onto a horizontal line indicates how much of the upper document appears in the lower one. Likewise, a vertical projection indicates how much of the lower document appears in the upper.

Tool: SIM SIM, or Software Similarity Tester, is used to detect the similarity between two computer programs. It examines the correctness, style, and uniqueness of the program. Each input C source file is passed to the lexical analyzer to generate a compact structure in terms of streams of integers known as tokens. Each token symbolizes either arithmetical or logical operations like a punctuation symbol, a C macro, a keyword, a numeric or string constant, a comment, or an identifier. After the two source files get tokenized, the token stream of the second program is divided into sections. Each section represents a module of the original program, and each module gets compared with the token stream of the first program separately. This technique enables SIM to detect similarities even if the positions in the module are changed. When the tokens are compared, their alignment is scored as follows: • A match involving two identifier tokens scores 2; other matches score 1. • A gap scores –2. • A mismatch involving two identifiers scores 0; other mismatches score –2. The total alignment score is calculated from the individual score for each block, and then it is normalized. This process is shown in Figure 9-8.

Tool: PLAGUE PLAGUE, or Plagiarism in University Environments, is an open repository of resources assisting students and academics in detecting plagiarism in software code and protecting themselves against it.

Copyright

9-17

File1 Token Source

Program

Tokens

Scanner

Alignment

Sigma Block

Tokens Source

File2

Function Function

Token

Block

Normalized Score

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 9-8

SIM compares computer programs.

PLAGUE compares all of the following: • Comments and layout • Case • Identifier replacement • Program output variations • String/character constant variations • Order of functions and classes • Order of case/if-else branches • Redundant syntax • Lexical token streams • Artificial bias resulting from tight specifications or reusable exercise templates

Tool: SPlaT SPlaT checks documents for any similarity between them. It functions in the following four modes: • Web spider mode: SplaT crawls through the Web sites of any department in the organization and downloads research papers to search for plagiarism. • Reviewer’s workbench mode: SPlaT compares a paper under review to a record of the author’s previously published articles extracted from Web sites and online article repositories. • Author mode: SPlaT allows authors, who are wary of committing self-plagiarism by accident, to check a new paper against their previous publications. • Local search: SPlaT compares files already downloaded to a directory. Figure 9-9 shows SPlaT running. The results show a list of all comparisons that had nonzero overlap, sorted alphabetically or by cheat amount. Clicking on any entry will show the two files side by side with the overlaps highlighted, as shown in Figure 9-10.

Tool: Sherlock Sherlock is a command-line program that finds the similarities between textual documents. It uses digital signatures for finding similar pieces of text in the documents. It works with text files, source code files, and assignments that are in digital form. It works with tar files, but not other compressed files. Sherlock is shown in action in Figure 9-11.

9-18

Chapter 9

Figure 9-9

Figure 9-10

SPlaT compares documents for similarities.

SPlaT highlights the similarities between files.

Copyright

9-19

Figure 9-11 Sherlock detects plagiarism between text documents.

The following are some example Sherlock commands: • Sherlock *.txt This compares the text files in the directory and produces a list of files that are similar. • Sherlock *.java This compares the Java source files in the directory. • Sherlock *.java > results.txt This compares the Java source files in the directory and outputs the results to a file called results.txt.

Tool: Urkund Urkund checks documents against Web pages, published material, and other documents. After checking the documents, it sends an overview via e-mail. It exempts quotations from comparison and handles 300 different file types.

Tool: PRAISE Plotted Ring of Analyzed Information for Similarity Exploration (PRAISE) examines all the documents that are collected and plots them on a torc in a sequence determined by gross nonoriginality. A group of documents that are associated with a particular document are highlighted. A pair of documents can be selected for further investigation in VAST. It works with plain text files, Microsoft Word documents, and HTML documents. The PRAISE interface is shown in Figure 9-12. Tool: SafeAssignment SafeAssignment analyzes any text, sentence by sentence, in order to determine whether the sentences are taken from the Internet or from its databases. It creates convenient and easy-to-read reports where all the unoriginal content is highlighted. Its process is shown in Figure 9-13. The originality detection process is simple and entirely automatic once the parameters of plagiarism-checked assignments have been set. It can detect even inexact matching. This is geared specifically toward teachers and may have limited usage in a corporate environment. Tool: EVE2 (Essay Verification Engine) EVE2 determines if information is plagiarized from the World Wide Web. It accepts essays in plain text, Microsoft Word, or Corel WordPerfect format, and returns links to Web pages from which material may have originated, without too many false positives. Once the search is completed, a full report, including the percentage of the essay plagiarized and an annotated copy of the paper showing plagiarism highlighted in red, is presented. A report is shown in Figure 9-14.

9-20

Chapter 9

Figure 9-12 PRAISE clusters documents and plots them according to their similarity.

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 9-13 SafeAssignment compares text, sentence by sentence, with its own databases.

Tool: WCopyfind WCopyfind extracts the text portions of a collection of document files. It then searches them for matching words in phrases of a specified minimum length. If WCopyfind finds two files that share enough words in those phrases, it generates a report in HTML format. The report contains the text of both documents with the matching phrases underlined. It can handle text, HTML, and some older word processor files. Tool: iThenticate iThenticate compares documents to a publications database comprising more than 10,000 major newspapers, magazines, and journals. It is designed to provide service for corporate organizations. Its interface is pictured in Figure 9-15.

Copyright

Figure 9-14

9-21

EVE2 compares documents to Web sites.

Figure 9-15 iThenticate checks against newspapers, magazines, and journals for plagiarism.

Tool: Glatt The Glatt Plagiarism Screening Program (GPSP) is a comprehensive computer software program specifically designed for detecting plagiarism.

Tool: Dupli Checker Dupli Checker (http://www.duplichecker.com) is a freeware online plagiarism detection tool, shown in Figure 9-16. Tool: PlagiarismDetect.com PlagiarismDetect.com is another freeware online plagiarism detection tool, shown in Figure 9-17.

9-22

Chapter 9

Figure 9-16

Dupli Checker uses search engines to check text for plagiarism.

Figure 9-17

PlagiarismDetect.com is freeware.

Tool: Forensic Linguistics Institute The Forensic Linguistics Institute, whose antiplagiarism Web site is shown in Figure 9-18, is mainly aimed at researchers, and performs the following tasks on a submitted work: • Does a brief study of the work’s field of research • Compares the work’s research aims and the current research profile of the field

Patent

9-23

Figure 9-18 The Web site of the Forensic Linguistics Institute (http:// plagiarism.org.uk) is one of the longest running antiplagiarism sites.

• Compares the work’s conclusions with what is already publicly available on the Internet • Offers search for collocations of keywords • Checks to see that important quotes have been properly referenced • Reports on any extent to which the work appears to infringe on existing works • Issues a certificate reporting on the work done by the Web site

Patent A patent is a property right granted to the inventor by the USPTO to keep others from making, using, or selling the invention without authorization. A patent is effective for up to 20 years from the date it is filed. According to patent law, a patent is granted on the new and unique article. Any article, process, or manufacture that claims patent is required to prove its usefulness. Patent law says that an invention cannot be patented if the invention already existed and was known or used by others prior to the applicant’s invention. Also, an invention cannot be patented if it has already been patented or if it has been sold or used publicly for at least a year. There are three types of patents: 1. Utility patents are granted to individuals who discover or invent new machines, processes, useful compositions of matter, or manufactured items, such as the following: • Machine: motorcycle, car • Process: fraction distillation of petroleum • Composition of matter: alloys, drugs • Manufactured item: paper, calculator

9-24

Chapter 9

2. Design patents are granted to individuals who invent new original designs for an article to be manufactured. It protects the appearance of an article. Examples include a computer cabinet or a container. 3. Plant patents are granted to individuals who invent, discover, or asexually reproduce new varieties of plants.

Patent Infringement According to the USPTO, “Patent infringement is unauthorized making, using, offering to sell, selling or importing into the United States any patented invention.” Infringement can be classified as one of the following: • Direct infringement is selling, using, or making a patented creation. It can be classified as the following: • Literal infringement occurs with each limitation in the asserted claims present in the accused device. • Infringement under the doctrine of equivalents occurs when the difference between the patented device and the accused device becomes insubstantial. • Indirect infringement is instigating another person to sell, make, or use a patented invention. • Contributory infringement is participating in the making or supplying of products that are meant for a patented invention. Resolving patent infringement is a two-step process involving the following: 1. Analyzing the claims by going through all patented documents 2. Verifying the claim for its authenticity

Patent Search The following is the seven-step strategy proposed by the USPTO for a patent search: 1. Index to the U.S. Patent Classification: It is an alphabetical index in which someone can view the general terms depicting the invention and its function, effect, end product, structure, and use. A person can note class and subclass numbers and can then refer to the Manual of Classification. 2. Manual of Classification: Class and subclass numbers noted down earlier can be referenced to find out where the terms fall within the U.S. Patent Classification System. Search the entire class and give importance to the dot indent. 3. Classification Definitions: Go through the definitions to establish the relevancy of classes and subclasses to the search. The definitions comprise important search notes and suggestions that can be referred to in further searches. 4. Browse Patent Titles and Abstracts: Inspect whether the search is in the right direction or not. If not, redirect the search and find out lists of patents and published applications containing the right keywords to initiate the search again. 5. Retrieve Subclass Listing: Retrieve a list of all patent numbers (granted from 1790 to the present) once the relevant classes or subclasses are identified. 6. Official Gazette—Patent Section: Refer to the Gazette section and find out ideal claims and a representative drawing for all patents on the lists. This step will eliminate unrelated patents. Published applications can be viewed online. 7. Complete Patent Document: Examine the complete text and drawings of relevant patents and compare it with the invention. This will help in determining similarities and dissimilarities in the invention and published patents.

Tool: http://www.ip.com The IP.com Prior Art Database provides companies with a way to publish their innovations in a publicly searchable, library-indexed collection of prior art. It allows a company to easily provide evidence in the event of a patent dispute.

Intellectual Property

9-25

How IP.com Works 1. Prepare a disclosure using normal business software, such as Microsoft Word. 2. Upload the files, along with some bibliographic information about the file, to the servers at IP.com. 3. Files are scanned and digital fingerprints are generated. Fingerprints provide a digital signature of a file’s contents. 4. The primary file is automatically scanned for searchable text content, which gets extracted from the document in order to make it searchable. 5. Additional IP.com-generated information is bundled with the document into a single Zip file. 6. The newly generated package is assigned a permanent IP.com number. IP.com numbers are assigned to uniquely identify protected files at IP.com. 7. The new disclosure is published and available online via the IP.com site.

Domain Name Infringement Anyone can register a domain name, but if it conflicts with an existing trademark, it constitutes domain name infringement. Responsibility lies with the domain name registrant to comply with trademark laws. Domain name infringement can be avoided if the domain name registrant checks whether their trademark is infringing upon another’s trademark before registering. If not, he or she can register a trademark. Consulting an attorney familiar with the Internet, trademarks, and related laws prior to domain name registration is another way to prevent domain name infringement.

How to Check for Domain Name Infringement A potential domain name proprietor can avoid the risk of trademark infringement by conducting a thorough investigation before registering a trademark. In order to minimize the chances of litigation, follow these five steps: 1. Use search engines such as Google to find out whether a domain name is already in use or not. Thoroughly examine all the links that could contain domain names identical to the desired name. This search can display all the businesses or services that have similar domain names. If the desired domain name is already registered, seek another domain name. 2. Search Whois.net to find out if any other businesses contain text identical to the desired domain name. Domain Surfer can also be utilized for a text string search. Domain Surfer is a Web site dedicated to help trademark owners and prospective domain name owners do a quick search to determine if a domain name is already registered. 3. Examine the Trademark Electronic Search System (TESS). This database contains trademarks and service marks that are all federally registered. It also contains dead or dumped trademarks and service marks, and all pending applications for trademark registration. 4. Engage an efficient search firm to do a national trademark, service mark, and domain name search. Search firms such as Thomson & Thomson do a comprehensive search and provide all results in a written report. 5. Appoint a trademark attorney to perform all activities described in the above steps. Domain name registration requires an attorney’s skills and knowledge to interpret trademark laws, give answers to questions such as whether a desired domain name will infringe upon another’s trademark, and so on.

Intellectual Property Intellectual property is the product of intellect that includes copyrights and trademarks for commercial use. It is protected through various copyright, trademark, and patent laws. It is broadly classified into two types, which are as follows: • Copyright: a product of intellect that includes literary and artistic works • Industrial property: a product of intellect that includes patents, trademarks, industrial designs, and geographic indications of the source

9-26

Chapter 9

Investigating Intellectual Property Theft Intellectual property theft includes the theft of the following: • Unregistered trade secrets • Copyrighted, patented, or registered works • Trademark violations • Confidential proposals • Confidential work papers • Technical notes • Strategic business planning • Gray-market distributions • Counterfeiting • Illegal distributions • Unauthorized product diversions • Trade names or partials

Steps for Investigating Intellectual Property Theft The following are the steps involved in investigating intellectual property theft: 1. Check the type of theft. 2. Look for clues that indicate theft of intellectual property by: a. Performing a plagiarism check b. Checking whether the theft is from a single source or more than one c. Checking if there is a lack of reference or quoting for referred information d. Checking if the information is directly taken from the source 3. Search and find the source of the theft. 4. Use detection tools or various plagiarism detection tools to find the source. 5. Check for unauthorized sharing of software. 6. Document all the information for further reference.

Digital Rights Management (DRM) Digital rights management (DRM) is access-control technology used by manufacturers, publishers, and copyright holders to limit the usage of digital devices or information. It describes the technology that prevents unauthorized distribution and usage of content, media, or devices. It has been adopted by the entertainment industry, most online music stores, and e-book publishers. DRM involves the following: • Users pay for the content and gain it through their provider. • The content provider or Internet service provider (ISP) takes the billing list from the DRM center and sends authorized or encrypted content to the user. • The payment gateway takes payment requests from the DRM center and sends an approval of payment to it. • The DRM center takes content requests from the user after payment approval and then sends the billing list to the content providers or ISPs and authentication to the user. This process is shown in Figure 9-19.

Tool: Windows Media Digital Rights Management Windows Media Digital Rights Management (DRM) is a DRM solution included with Windows and is shown in Figure 9-20.

Digital Rights Management (DRM)

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 9-19

DRM allows the user to use protected content.

Figure 9-20 Windows Media Digital Rights Management is included with Windows.

9-27

9-28

Chapter 9

Tool: Haihaisoft Media DRM Platform The Haihaisoft Media DRM Platform enables the secure deployment of digital audio and video media. It provides a media DRM packager and an online management account. The packager is pictured in Figure 9-21.

Tool: LockLizard LockLizard is a document security and copy-protection program for PDF files, Flash files, e-books, and Webbased content. It protects information with strong encryption and DRM controls to ensure complete protection against copyright infringement. It can stop copying, prevent printing, disable Print Screen, expire content, and instantly revoke access to information. It provides copyright protection without the use of passwords to ensure maximum security, and to protect information, documents, and Web content from unauthorized use no matter where it resides. LockLizard’s Web interface is shown in Figure 9-22.

Tool: IntelliProtector IntelliProtector is a software activation service with a Web-based control panel that helps reduce a form of piracy known as casual copying. Casual copying is when people share software in a way that infringes on the software’s end-user license agreement (EULA). IntelliProtector enables distribution of software securely over the Internet, on CD-ROM, and on DVD. It ensures that users comply with the license terms associated with the product. This includes not sharing the product or using it simultaneously on more than one computer. The service provides reporting features, detailed statistics, and automatic license-key management. Its Window Manager is shown in Figure 9-23. IntelliProtector includes the following features: • Protection against piracy • Creates time-limited and feature-limited trials • Blocks license violators automatically • Integration with all popular payment processors • Automatic delayed delivery of the license code • Powerful reporting and statistics

Figure 9-21

Haihaisoft Media DRM Packager adds DRM to media files.

Digital Rights Management (DRM)

Figure 9-22

LockLizard provides real-time licensing control for documents.

Figure 9-23

IntelliProtector provides several options for protecting software.

9-29

9-30

Chapter 9

U.S. Laws for Trademarks and Copyright The following sections discuss U.S. laws concerning trademarks and copyright.

The Digital Millennium Copyright Act (DMCA) of 1998 This act was signed into law and passed on October 28, 1998, by President Clinton. It is subdivided into five titles: • WIPO (World Intellectual Property Organization) Copyright and Performances and Phonograms Treaties Implementation Act of 1998 implements the WIPO treaties. Article 11 of the WCT (WIPO Copyright Treaty) states: Contracting Parties shall provide adequate legal protection and effective legal remedies against the circumvention of effective technological measures that are used by authors in connection with the exercise of their rights under this Treaty or the Berne Convention and that restrict acts, in respect of their works, which are not authorized by the authors concerned or permitted by law. Article 12 of the WCT provides the relevant part: Contracting Parties shall provide adequate and effective legal remedies against any person knowingly performing any of the following acts, or with respect to civil remedies having reasonable grounds to know, that it will induce, enable, facilitate or conceal an infringement of any right covered by this Treaty or the Berne Convention: (i) to remove or alter any electronic rights management information without authority; (ii) to distribute, import for distribution, broadcast, or communicate to the public, without authority, works or copies of works knowing that electronic rights management information has been removed or altered without authority. The new section 1202 is the provision implementing this obligation to protect the integrity of Copyright Management Information (CMI). The scope of the protection is set out in two separate paragraphs, the first dealing with false CMI and the second with removal or alteration of CMI. Subsection (a) prohibits the knowing provision or distribution of false CMI, if done with the intent to induce, enable, facilitate, or conceal infringement. Subsection (b) bars the intentional removal or alteration of CMI without authority, as well as the dissemination of CMI or copies of works, knowing that the CMI has been removed or altered without authority. • Online Copyright Infringement Liability Limitation Act: Title II of the DMCA adds a new section 512 to the Copyright Act3 to create four new limitations on liability for copyright infringement by online service providers. The limitations are based on the following four categories of conduct by a service provider: 1. Transitory communications; 2. System caching; 3. Storage of information on systems or networks at the direction of users; and 4. Information location tools. • Computer Maintenance Competition Assurance Act: Title III expands the existing exemption relating to computer programs in section 117 of the Copyright Act, which allows the owner of a copy of a program to make reproductions or adaptations when necessary to use the program in conjunction with a computer. The amendment permits the owner or lessee of a computer to make or authorize the making of a copy of a computer program in the course of maintaining or repairing that computer. The exemption only permits a copy that is made automatically when a computer is activated, and only if the computer already lawfully contains an authorized copy of the program. The new copy cannot be used in any other manner and must be destroyed immediately after the maintenance or repair is completed.

U.S. Laws for Trademarks and Copyright

9-31

• Miscellaneous provisions: Section 401(b) adds language to section 701 of the Copyright Act confirming the Copyright Office’s authority to continue to perform the policy and international functions that it has carried out for decades under its existing general authority. • Vessel Hull Design Protection Act: Title V of the DMCA, entitled the Vessel Hull Design Protection Act (VHDPA), adds a new chapter 13 to Title 17 of the U.S. Code. It creates a new system for protecting original designs of certain useful articles that make the article attractive or distinctive in appearance. For purposes of the VHDPA, “useful articles” are limited to the hulls (including the decks) of vessels no longer than 200 feet.

The Lanham (Trademark) Act (15 USC §§ 1051–1127) This act was first passed on July 5, 1946, and was signed into law by President Harry Truman. It concerns activities like trademark infringement, trademark dilution, and false advertising, and is subdivided into four chapters, one of which is partially quoted below: TITLE 15 – COMMERCE AND TRADE CHAPTER 22 – TRADEMARKS SUBCHAPTER III – GENERAL PROVISIONS Sec. 1114. Remedies; Infringement; Innocent Infringement By Printers And Publishers (1) Any person who shall, without the consent of the registrant — a) use in commerce any reproduction, counterfeit, copy, or colorable imitation of a registered mark in connection with the sale, offering for sale, distribution, or advertising of any goods or services on or in connection with which such use is likely to cause confusion, or to cause mistake, or to deceive; or b) reproduce, counterfeit, copy, or colorably imitate a registered mark and apply such reproduction, counterfeit, copy, or colorable imitation to labels, signs, prints, packages, wrappers, receptacles or advertisements intended to be used in commerce upon or in connection with the sale, offering for sale, distribution, or advertising of goods or services (2) Notwithstanding any other provision of this chapter, the remedies given to the owner of a right infringed under this chapter or to a person bringing an action under section 1125(a) of this title shall be limited as follows: a) Where an infringer or violator is engaged solely in the business of printing the mark or violating matter for others and establishes that he or she was an innocent infringer or innocent violator, the owner of the right infringed or person bringing the action under section 1125(a) of this title shall be entitled as against such infringer b) Where the infringement or violation complained of is contained in or is part of paid advertising matter in a newspaper, magazine, or other similar periodical or in an electronic communication as defined in section 2510(12) of title 18

Doctrine of “Fair Use” Section 107 of the Copyright Law mentions the doctrine of “fair use.” This doctrine is a result of a number of court decisions over the years. Reproduction of a particular work for criticism, news reporting, comment, teaching, scholarship, and research is considered as fair according to Section 107 of the Copyright Law. The copyright office does not give permission to use copyrighted works. It is advised to obtain permission from the owner of a particular copyrighted work. Section 107 also sets out four factors to be considered in determining whether or not a particular use is fair: • The purpose and character of the use, including whether such use is of commercial nature or is for nonprofit educational purposes; • The nature of the copyrighted work;

9-32

Chapter 9

• Amount and substantiality of the portion used in relation to the copyrighted work as a whole; and • The effect of the use upon the potential market for or value of the copyrighted work. One cannot easily differentiate between fair use and copyright infringement. There is no mention of the number of lines, words, and notes that one can take from a copyrighted work and still escape infringement.

Investigating Copyright Violations Copyright violation can be investigated in the following ways: 1. 2. 3. 4. 5.

Explanations of parties and third persons Testimonial evidences Written and material evidence Audio and video records Conclusions of experts

The following are the evidence of copyright violations: • The documents received by law enforcement agencies during checks committed by them on their own initiative or by complaints of rights owners • Record of examination of computer and software • Record of examination of a tangible carrier where the installation of software products on the computer was performed • Conclusion of expert performing examination of the seized computer and tangible carriers with software • Delivery note or cash memo for the purchased computer • Warranty statement on the purchased computer • Explanations of the employees of the seller company, explanations of the customer • Copies of statutory documents of a legal entity (statute and foundation agreement) • Job functions of the organization directly related to selling computer facilities and software • Advertising materials and price lists evidencing that accused person carried out entrepreneurial activity • Other documents related to the software's illegal sale or distribution in any form Counterfeit samples of software, the production or use of which involves copyright violations, are also referred to as evidence of copyright violation. Advertising materials, price lists, documents on goods, and other materials evidencing copyright violation are also regarded as evidence along with counterfeit samples. During investigation, it is necessary to establish, at least approximately, the volume of the obtained revenue from the violation of copyright and adjacent rights. The following accounting documents should be analyzed and attached to the file: • Reports of different checks and inspections; • Delivery notes, charge tickets, other documents reflecting transaction of products and payment; • Financial statements (reports delivered to tax office); • Agreements reflecting facts of criminal activity (transportation of products, issuance of goods to distributors, storing products at some place in some amount, etc.) • U.S. laws for trademarks and copyright

Online Copyright Infringement Liability Limitation Act Sec. 512. Limitations on liability relating to material online a) LIMITATION– Notwithstanding the provisions of section 106, a provider shall not be liable for— (1) Direct infringement, based solely on the intermediate storage and transmission of material over that provider’s system or network, if— (A) The transmission was initiated by another person; (B) The storage and transmission is carried out through an automatic technological process, without any selection of that material by the provider; and

Indian Laws for Trademarks and Copyright

9-33

(C) Any copy made of the material is not retained longer than necessary for the purpose of carrying out that transmission; (2) Monetary relief under section 504 or 505 for contributory infringement or vicarious liability, based solely on conduct described in paragraph (1); or (3) Monetary relief under section 504 or 505 for contributory infringement or vicarious liability, based solely on transmitting or providing access to material over that provider’s system or network, other than conduct described in paragraph (1), if the provider— (A) Does not know and is not aware of information indicating that the material is infringing; and (B) Does not receive a financial benefit directly attributable to the infringing activity. b) PROTECTION OF PRIVACY—Nothing in subsection (a) shall authorize or obligate a provider to access material that the provider is prohibited by law from accessing, or impose an affirmative obligation to monitor or otherwise seek information indicating infringement. c) LIMITATION BASED UPON REMOVING OR DISABLING ACCESS TO INFRINGING MATERIAL—A provider shall not be liable for any claim based on that provider’s removing or disabling online access to material, in response to knowledge or information indicating that the material is infringing, whether or not the material is infringing. d) OTHER DEFENSES NOT AFFECTED—Removing or disabling access to material which a provider transmits online or to which a provider provides online access, or the failure to do so, shall not adversely bear upon the consideration by a court of a defense to infringement asserted by that provider on the basis of section 107 or any other provision of law. e) MISREPRESENTATIONS—Any person who knowingly materially misrepresents that material online is infringing shall be liable for any damages, including costs and attorneys’ fees, incurred by the alleged infringer or by any copyright owner or copyright owner’s authorized licensee who is injured by such misrepresentation, or by any provider who relies upon such misrepresentation in removing or disabling access to the material claimed to be infringing.

Indian Laws for Trademarks and Copyright The Patents (Amendment) Act, 1999 (1) This Act may be called the Patents (Amendment) Act, 1999. (2) It shall be deemed to have come into force on the 1st day of January, 1995. 24B.(1) Where a claim for patent covered under subsection (2) of section 5 has been made and the applicant has— a) where an invention has been made whether in India or in a country other than India and before filing such a claim, filed an application for the same invention claiming identical article or substances in a convention country on or after the 1st day of January, 1995 and the patent and the approval to sell or distribute the article or substance on the basis of approval tests conducted on or after the 1st day of January, 1995, in that country has been granted on or after the date of making a claim for patent covered under subsection (2) of section 5; or b) where an invention has been made in India and before filing such a claim, made a claim for patent on or after the 1st day of January, 1995 for method or process of manufacture for that invention relating to identical article or substance and has been granted in India the patent therefore on or after the date of making a claim for patent covered under subsection (2) of section 5, and has received the approval to sell or distribute the article or substance from the authority specified in this behalf by the Central Government

Trade Marks Act, 1999 This act was signed into law and was passed on December 23, 1999, by the Indian parliament. This law repealed and replaced the Trade and Merchandise Marks Act. This law provides the registration of trademarks relating to goods and services.

9-34

Chapter 9

This law states that it is considered an offense if, a person whoa) Falsifying and falsely applying trademarks b) Without the assent of the proprietor of the trademark makes that trademark or a deceptively similar mark; or c) Falsifies any genuine trademark, whether by alteration, addition, effacement or otherwise. (2) A person shall be deemed to falsely apply to goods or services a trademark who, without the assent of the proprietor of the trademark, a) applies such trademark or a deceptively similar mark to goods or services or any package containing goods; b) Uses any package bearing a mark which is identical with or deceptively similar to the trademark of such proprietor, for the purpose of packing, filling or wrapping therein any goods other than the genuine goods of the proprietor of the trademark. (4) In any prosecution for falsifying a trademark or falsely applying a trademark to goods or services, the burden of proving the assent of the proprietor shall lie on the accused. And who selling goods or providing services to which false trademark or false trade description is applied. Any person whoCauses any of things above-mentioned in this section to be done, Shall, unless he proves that he acted, without intent to defraud, be punishable with imprisonment for a term which shall not be less than six months but which may extend to three years and with fine which shall not be less than fifty thousand rupees but which may extend to two lakh rupees: PROVIDED that the court may, for adequate and special reasons to be mentioned in the judgment, impose a sentence of imprisonment for a term of less than six months or a fine of less than fifty thousand rupees. Source: http://www.indialawinfo.com/bareacts/cpr.html The Copyright Act, 1957: This Act may be called the Copyright Act, 1957; it extends to the whole of India. This law states that, it is an offense when Any person who knowingly infringes or abets the infringement ofa) the copyright in a work, or b) any other right conferred by this Act, [except the right conferred by section 53A], shall be punishable with imprisonment for a term which shall not be less than six months but which may extend to three years and with fine which shall not be less than fifty thousand rupees but which may extend to two lakh rupees: PROVIDED that [where the infringement has not been made for gain in the course of trade or business] the court may, for adequate and special reasons to be mentioned in the judgment, impose a sentence of imprisonment for a term of less than six months or a fine of less than fifty thousand rupees. Any person who knowingly makes use on a computer of an infringing copy of a computer program shall be punishable with imprisonment for a term which shall not be less than seven days but which may extend to three years and with fine which shall not be less than fifty thousand rupees but which may extend to two lakh rupees. Possession of plates for purpose of making infringing copies Any person who knowingly makes, or has in his possession, any plate for the purpose of making infringing copies of any work in which copyright subsists shall be punishable with imprisonment which may extend to two years and shall also be liable to fine.

Japanese Laws for Trademarks and Copyright Trademark Law The Trademark Law that was promulgated in Japan on June 12, 1996, entered into effect on April 1, 1997. The following are the principal changes that were effected by the law: • Three-dimensional trademarks consisting of the shape of goods or their packaging may be registered, provided they are distinguishable and are not indispensable to secure the function of the goods or their packaging. • Collective trademarks may be registered.

Australian Laws for Trademarks and Copyright

9-35

• Associated trademarks registered or pending on April 1, 1997, are deemed to be independent trademarks. • Applications for trademarks that are held to be identical or similar to a well-known trademark filed with an unjust purpose will be rejected, irrespective of whether there is a likelihood of confusion between the respective goods and/or services. • A single application may cover several classes of goods and/or services. However, applications for the same mark filed on the same date in more than one class prior to April 1, 1997, may not be consolidated into one application. • It is no longer necessary to submit evidence of use to support renewals of trademark registrations. Belated renewals may be filed six months following the expiration date of the registration, subject to payment of additional fees. • It is no longer necessary to publish a Notice of Assignment of a registered trademark. • A general Power of Attorney is now accepted. • Any person may file a cancellation action based on nonuse of a registered trademark for more than three consecutive years. • Use of a registered trademark by the owner or licensee within three months prior to the date of filing of a cancellation action will not be considered legitimate use, provided that the petitioner in the cancellation action can prove that the trademark owner or licensee commenced such use upon becoming aware of the prospective cancellation action. • If a cancellation action is successful, the trademark registration is deemed to have been cancelled retroactively as of the date of filing of the cancellation action. • A postregistration opposition procedure replaces the current preregistration opposition system. An opposition may be filed by any interested party within two months following the date of publication of a registered mark. • Japan adopted the International Classification system on April 1, 1992. Under the new trademark law, the goods covered by those registered trademarks that were filed on or before March 31, 1992, in accordance with the four versions of the earlier Japanese classifications (of 1899, 1909, 1921, and 1959) will be reclassified in accordance with the International Classification system upon renewal. The reclassification will commence with trademark registrations that expire on or after October 1, 1998.

Copyright Management Business Law (4.2.2.3 of 2000) In November 2000, the Copyright Management Business Law (4.2.2.3) was enacted. Its main purpose is to facilitate the establishment of new copyright management businesses, in order to “respond to the development of digital technologies and communication networks.”

Australian Laws for Trademarks and Copyright The Trade Marks Act 1995 Section 145 (1) A person is guilty of an offense if the person falsifies or unlawfully removes a trademark that: a) has been applied to any goods that are being, or are to be, dealt with or provided in the course of trade; or b) has been applied in relation to any goods or services that are being, or are to be, dealt with or provided in the course of trade; Knowing that the trademark is registered or regardless of whether or not the trademark is registered. (2) A person falsifies a registered trademark if the person: a) alters or defaces it; or b) makes any addition to it; or

9-36

Chapter 9

c) partly removes, erases, or obliterates it; without the permission of the registered owner, or an authorized user, of the trademark, Section 148 A person is guilty of an offense if the person intentionally: a) sells goods; or b) exposes goods for sale; or c) has goods in his or her possession for the purpose of trade or manufacture; or d) imports goods into Australia for the purpose of trade or manufacture; knowing that, or regardless of whether or not: e) a falsified registered trademark is applied to them or in relation to them; or f) a registered trademark has been unlawfully removed from them; or g) a registered trademark is falsely applied to them or in relation to them. Penalty for offense under section 145, 148 A person guilty of an offense under section 145, 146, 147 or 148 is punishable on conviction by: a) a fine not exceeding 500 penalty units; or b) imprisonment for a period not exceeding 2 years; or c) by both a fine and a term of imprisonment. False representations regarding trademarks is also considered as the offense.

The Copyright Act 1968: Section 132 According to this law, following are the offenses: Offenses relating to infringing copies (1) A person shall not, at a time when copyright subsists in a work: a) make an article for sale or hire or with the intention of obtaining a commercial advantage or profit; b) sell or let for hire, or by way of trade, or with the intention of obtaining a commercial advantage or profit, offer or expose for sale or hire, an article; c) import an article into Australia for the purpose of: i. selling, letting for hire, or by way of trade, or with the intention of obtaining a commercial advantage or profit, offering or exposing for sale or hire, the article; If the person knows, or ought reasonably to know, the article to be an infringing copy of the work. (2) A person shall not, at a time when copyright subsists in a work, distribute: a) for the purpose of trade or with the intention of obtaining a commercial advantage or profit; or b) for any other purpose to an extent that affects prejudicially the owner of the copyright; (3) A person shall not, at a time when copyright subsists in a work, make or have in his or her possession a device that the person knows, or ought reasonably to know, is to be used for making infringing copies of the work. (4) The preceding provisions of this section apply in relation to copyright subsisting in any subject matter by virtue of Part IV in like manner as they apply in relation to copyright subsisting in a work by virtue of Part III. Offense relating to infringing public performances of literary, dramatic or musical works (5) A person shall not cause a literary, dramatic or musical work to be performed in public at a place of public entertainment, if the person knows, or ought reasonably to know, that copyright subsists in the work and that the performance constitutes an infringement of the copyright. (5C) A person commits an offense if: a) copyright subsists in a work or other subject matter; and

U.K. Laws for Trademarks and Copyright

9-37

b) either: i. the person removes, from a copy of the work or subject matter, any electronic rights management information that relates to the work or subject matter; or ii. the person alters any electronic rights management information that relates to the work or subject matter; and c) the person does so without the permission of the owner or exclusive licensee of the copyright; and d) the person is reckless as to whether the removal or alteration will induce, enable, facilitate or conceal an infringement of the copyright.

U.K. Laws for Trademarks and Copyright The Copyright, etc. and Trade Marks (Offences and Enforcement) Act 2002 This act was signed into law and passed on July 24, 2002, by the Department of Trade and Industry. This Act amends the criminal provisions in intellectual property law, more specifically the law relating to copyright, rights in performances, fraudulent reception of conditional access transmissions by use of unauthorized decoders, and trademarks. The Copyright, etc. and Trade Marks (Offences and Enforcement) Act has three main powers. It: • Increases the penalties for the offense of copyright theft to 10 years to match trademark law so it is no longer a low risk option for organized crime • Strengthens search warrant provisions to make it easier to expose counterfeiting and piracy • Gives greater powers to allow rights to owners to obtain forfeiture of infringing material to reduce the current potential return for criminals Counterfeiting and piracy is now regularly included in the NCIS National Threat Assessment Report. It was clear that a stronger deterrent was needed, particularly as counterfeiting and piracy are increasingly linked with organized crime. Greater penalties provide that deterrent.

Trademarks Act 1994 (TMA) This act was signed into law and passed on July 1, 1995. This law amends the registration of trademarks and protection of registered trademarks. This law states that: (1) A person commits an offense who, with a view to gain for himself or another, or with intent to cause loss to another, and without the consent of the proprietora) applies to goods or their packaging a sign identical to, or likely to be mistaken for, a registered trademark, or b) sells or lets for hire, offers or exposes for sale or hire, or distributes goods which bear, or the packaging of which bears, such a sign, or (2) A person commits an offense who, with a view to gain for himself or another, or with intent to cause loss to another, and without the consent of the proprietor a) applies a sign identical to, or likely to be mistaken for, a registered trademark to material intended to be usedi. for labeling or packaging goods, ii. as a business paper in relation to goods, or iii. for advertising goods, or b) uses in the course of a business material bearing such a sign for labeling or packaging goods, as a business paper in relation to goods, or for advertising goods (3) A person commits an offense who, with a view to gain for himself or another, or with intent to cause loss to another, and without the consent of the proprietor a) makes an article specifically designed or adapted for making copies of a sign identical to, or likely to be mistaken for, a registered trademark, or

9-38

Chapter 9

b) has such an article in his possession, custody, or control in the course of a business knowing or having reason to believe that is has been, or is to be, used to produce goods or material for labeling or packaging goods, as a business paper in relation to goods, or for advertising goods.

Chinese Laws for Trademarks and Copyrights Copyright Law of People’s Republic of China (Amendments on October 27, 2001) • Article 1: The purpose of protecting the copyright of authors in their literary, artistic, and scientific works and the copyright-related rights and interests. • Article 2: Works of Chinese citizens, legal entities, or other organizations, whether published or not, shall enjoy copyright in accordance with this Law.

Trademark Law of the People’s Republic of China (Amendments on October 27, 2001) This law was enacted for the purposes of improving the administration of trademarks, protecting the exclusive right to use trademarks, and of encouraging producers and operators to guarantee the quality of their goods and services and maintaining the reputation of their trademarks, with a view to protecting the interests of consumers, producers, and operators, and to promoting the development of the socialist market economy.

Canadian Laws for Trademarks and Copyrights Copyright Act (R.S., 1985, c. C-42) This act grants protection to an architectural work, artistic work, Berne convention country, commission, book, broadcaster, choreographic work, cinematographic work, collective society, work, or combination of these, used by traders on their goods and services to indicate their origin.

Trademark Law This law states that if a mark is used by a person as a trademark for any of the purposes or in any of the manners, it shall not be held invalid merely on the ground that the person or a predecessor in title uses it or has used it for any other of those purposes or in any other of those manners.

South African Laws for Trademarks and Copyright Trademarks Act 194 of 1993 This act provides the registration of trademarks, certification trademarks, and collective trademarks.

Copyright Act of 1978 This act regulates copyright and provides for matters incidental thereto.

Patents Act No. 57 of 1978 This act provides for the registration and granting of letters patent for inventions and for matters connected therewith.

Chapter Summary

9-39

South Korean Laws for Trademarks and Copyright Copyright Law Act No. 3916 The purpose of this act is to protect the rights of authors and the rights neighboring on them and to promote fair use of works in order to contribute to the improvement and development of culture.

Industrial Design Protection Act The purpose of this act is to encourage the creation of designs by ensuring their protection and utilization so as to contribute to the development of industry.

Belgian Laws for Trademarks and Copyright Copyright Law, 30/06/1994 The purpose of the act is to protect literary and artistic works from unauthorized usage. The author of a work alone shall have the right to reproduce his or her work or to have it reproduced in any manner or form whatsoever.

Trademark Law, 30/06/1969 This law approves the Benelux Convention Concerning Trademarks and Annex, signed in Brussels on March 19, 1962. The high contracting parties shall incorporate into their domestic legislation, in one or both of the original texts, the Benelux Uniform Law on Trade Marks annexed to this Convention and shall establish an administration common to their countries under the name Benelux Trade Marks Bureau.

Hong Kong Laws for Intellectual Property Hong Kong’s IP laws are based on constitutional or basic law provisions.

Article 139 of the Basic Law Government shall formulate policies on science and technology and protect achievements in scientific research.

Article 140 of the Basic Law This law protects the rights of authors in their literary and artistic creations.

Chapter Summary ■

A trademark is a word, phrase, symbol, or design that identifies and distinguishes the goods of one party from those of others.

■

Copyright is a form of protection provided to the owners of original works.

■

Plagiarism is using others’ ideas and words without clearly acknowledging the source of that information.

■

According to the USPTO, “A patent is a property right granted to the inventor by the USPTO to keep others from making, using, or selling the invention without authorization.”

■

Intellectual property is a product of intellect that includes copyrights and trademarks for commercial use.

■

DRM is access control technology used by manufacturers, publishers, and copyright holders to limit the usage of digital devices or information.

9-40

Chapter 9

Review Questions 1. Explain fair use. __________________________________________________________________________________________ __________________________________________________________________________________________ 2. How do you investigate the copyright status of a work? __________________________________________________________________________________________ __________________________________________________________________________________________ 3. What is a service mark? __________________________________________________________________________________________ __________________________________________________________________________________________ 4. What is a patent? __________________________________________________________________________________________ __________________________________________________________________________________________ 5. What is plagiarism? __________________________________________________________________________________________ __________________________________________________________________________________________ 6. What tools are available for detecting plagiarism? __________________________________________________________________________________________ __________________________________________________________________________________________ 7. What are paper mills? __________________________________________________________________________________________ __________________________________________________________________________________________ 8. Explain digital rights management (DRM). __________________________________________________________________________________________ __________________________________________________________________________________________

Hands-On Projects 1. Search for a trademark at the USPTO. ■

Visit http://www.uspto.gov.

■

Click Trademark search.

■

Type CEH in the search field.

2. Research the SCO vs. IBM copyright claim. ■

Visit http://www.groklaw.net.

■

Read various articles related to SCO and IBM with respect to the lawsuit.

Hands-On Projects

3. Investigate plagiarism. ■

Visit http://www.turnitin.com.

■

Explore the various services provided by this site.

4. Use the CopyCatch program to find plagiarism in a given file. ■

Navigate to Chapter 9 of the Student Resource Center.

■

Install and launch CopyCatch.

■

Explore the program’s various options.

5. Use the SPlaT program to find plagiarism in a given file. ■

Navigate to Chapter 9 of the Student Resource Center.

■

Install and launch the SPlaT program.

■

Explore the program’s various options.

9-41

This page intentionally left blank

10

Chapter

Investigating Sexual Harassment Incidents

Objectives After completing this chapter, you should be able to: • • • • • • • • • •

Understand sexual harassment Describe the types of sexual harassment Understand the consequences of sexual harassment Understand the responsibilities of supervisors Understand the responsibilities of employees Follow the complaint procedures Understand the investigation process Understand sexual harassment policy Describe steps for preventing sexual harassment Describe laws on sexual harassment

Key Terms Cyberbullying the use of information technology to tease or intimidate individuals, usually minors, causing them harm; it can include sending mean or vulgar images and threatening messages, posting private or untrue information about a person to cause them humiliation or social exclusion, or pretending to be someone else with the intent to cause harm to the target individual Cyberstalking the use of information technology such as e-mail or the Internet to repeatedly threaten or harass another individual, group, or organization with false acusations, identity theft, soliciation for sexual purposes, or the gathering of information for further harassment. This behavior is often a prelude to more serious physical violence. Sexual harassment a kind of sexual behavior that is offensive to the victim and may cause harm to the victim physically, psychologically, and materially because such behavior is against the consent of the victim Stalking a repeated, unwelcomed activity that involves gazing at, following, or harassing another person 10-1

10-2

Chapter 10

Case Example 1 A 21-year-old Adelaide woman accused her boss, Wayne Jeffrey Jaye, managing director of Studio Silva Photography, of sexually harassing her in 2003. When the employee refused to respond to the boss’s advances, he allegedly fired her from her job. The victim filed a suit against Jaye, but he ignored her complaint and made no effort to defend himself in court. The tribunal, however, found that he persistently harassed his female employee. The employee won the case in September 2006 and was awarded more than $20,000 in compensation.

Case Example 2 The radio dispatcher at the Arkansas State Police Department accused a police sergeant of sexually harassing her. The sergeant had made derogatory comments about her physical appearance. The dispatcher reported the sergeant’s behavior to the duty officer, who in turn informed a lieutenant. Investigations confirmed the allegations about the sergeant’s behavior. Eventually, the sergeant was demoted and transferred.

Case Example 3 An adult neighbor of a shy, reclusive teenage girl pretended to be a teenage boy attracted to her in e-mails and instant messaging conversations. Once the young victim became attached, the cyberbullying neighbor started denigrating and criticizing the victim, causing her to go into a depression and eventually commit suicide. Cyberbullying is the use of information technology to tease or intimidate individuals, usually minors, causing them harm. The neighbor was indicted by a federal grand jury on three counts of accessing protected computers without authorization to obtain information to inflict emotional distress, and one count of criminal conspiracy. She was found guilty on three lesser charges (reduced from felonies to misdemeanors by the jury).

Introduction to Investigating Sexual Harassment Incidents Sexual harassment is a kind of sexual behavior that is offensive to the victim and may cause harm to the victim physically, psychologically, and materially because such behavior is against the consent of the victim. Such behavior includes unwanted sexual advances, requests for sexual favors linked to implied threats or promises about career prospects, sexual attacks, unwanted physical conduct, visual displays of degrading sexual images, and offensive remarks of a sexual nature. This is an unwelcomed, unsolicited, and offensive act that creates a hostile or intimidating environment and affects an individual’s employment implicitly or explicitly. Sexual harassment may occur in the following circumstances: • It may occur between the opposite sex or the same sex. • The harasser may be a supervisor, coworker, client, vendor, contractor, or nonemployee. • The incident may include a group of persons or a particular person. • It may occur when a harasser uses obscene language toward a victim. • It may occur when a harasser invites the victim for social activities even though the victim is not interested. • It may occur when a person makes sexually offensive remarks or exhibits sexually explicit materials at the workplace. The remainder of this chapter delves further into sexual harassment and how to investigate it and prevent it. It also covers laws concerning sexual harassment.

Types of Sexual Harassment Sexual harassment is broadly classified into the following two categories: 1. Quid pro quo harassment 2. Hostile work environment harassment

Types of Sexual Harassment

10-3

Quid Pro Quo Harassment Quid pro quo harassment is a direct form of harassment where an employee is expected to tolerate harassment in order to receive some benefit. A benefit could be one of the following: • Keeping a job • Receiving a raise • Receiving a promotion • Receiving a good review An example of this is a superior promising an employee a promotion only if the employee is dating the superior.

Hostile Work Environment Harassment A hostile work environment is an abusive environment where an employee is subjected to unwelcomed sexual advances from coworkers. This harassment can be either verbal or physical. The following are a few of the situations that can lead to hostile work environment harassment: • Cracking dirty jokes or telling dirty stories intentionally • Posting pictures of pornography via e-mails or instant messages • Physical contact by touching, kissing, or hugging • Displaying photos, posters, or cartoons reflecting sexually suggestive themes • Flirting, asking for dates, or commenting on physique The following are a few elements that a victim has to prove if he or she is suffering from sexual harassment: • The employee suffered or is suffering from intentional and unwanted sexual advances. • The employee has made it clear that the advances are unwelcome. • The harassment has been repeated a number of times. • Management knew about the harassment and did not do anything to stop it. The following are types of sexual harassment that can create a hostile work environment: • Verbal • Telling obscene jokes or flirting • Using expletives toward fellow workers • Repetition of derogatory comments or slurs • Repeated unwelcome invitations to social activities or dates • Repeated unwelcome compliments with respect to personal physical appearance • Use of crude or obscene language or gestures • Displaying sexually explicit objects or pictures • Repeated sexually oriented kidding • Physical • Touching • Grabbing • Kissing • Teasing • Patting • Stroking • Hugging • Leering

10-4

Chapter 10

• Brushing against another’s body • Pinching • Whistling • Impeding or blocking another’s movement • Physical interference with normal work movement Note that sexual harassment can occur outside of the workplace. For example, sometimes an employee has to travel with a superior, and the superior may take the opportunity to sexually harass the employee. A superior may also sexually harass an employee in a public place, such as at an after-hours party.

Consequences of Sexual Harassment The following are some of the consequences of sexual harassment: • It may affect the victim’s work performance. • It may create a hostile work environment. • The employee may stop coming to work to avoid the harassment. • It may embarrass individuals who are exposed to the sexual behavior. • The company or organization may suffer from low productivity and low morale among the workforce. • It may lead to a loss of career, references, or recommendations for the employee. • Employees feel degraded because of constant inquiries and gossip at the workplace. • It may lead to job dissatisfaction and resignations to avoid the sexual harassment. • It may defame the organization; as a result, the organization may lose its goodwill in the marketplace. • Due to embarrassment and reluctance to bring the matter into the open, the victim may suffer from suicidal tendencies. • If a lawsuit is filed against the harasser, the culprit may be subjected to punitive actions.

Sexual Harassment Statistics Figure 10-1 shows a chart displaying the number of sexual harassment cases filed with the U.S. Equal Employment Opportunity Commission (EEOC).

Source: http://www.eeoc.gov/. Accessed 2/2007.

Figure 10-1 The U.S. Equal Employment Opportunity Commission receives thousands of sexual harassment complaints each year.

Stalking

10-5

The Dos and Don’ts if an Employee Is Being Sexually Harassed If an employee has been sexually harassed, he or she should never wait for anybody else to see what is happening. The employee must take initiative. The following are some of the things an employee should and should not do if he or she is being sexually harassed: • Express his or her views to the harasser (whether it is a superior or coworker) directly • Do not expect that others will help. • Tell the harasser to avoid sexual acts. • Do not make excuses for the perpetrator. • Do not pretend that nothing has happened. • Make it clear that he or she has the right to be free from sexual harassment. • Do not get manipulated by the harasser’s tactics. • Talk about the harassment. • Do not be silent, as that only protects the harasser. • Document each and every act performed by the harasser • Document the behavior of the harasser. • Write down each and every harassing instance, including the time, date, and any witnessing coworkers. • Document his or her own performance in the workplace for comparison with evaluated performance. • If possible, take video for evidence. • Check if other coworkers are experiencing the same problem. • Complain to management, and if management cannot help, lodge a complaint with the EEOC

Stalking Stalking is a repeated, unwelcomed activity that involves gazing at, following, or harassing another person. In some cases, it is caused by a mental disorder, and the perpetrator may try to force the victim into having a relationship with him or her. The stalker can be a former intimate, family member, workplace contact, friend, or stranger. Depending upon behavior patterns, stalkers are classified as follows: • Rejected stalker: A rejected stalker may be a person who is a former partner or ex-friend of the victim. The rejected stalker stalks the victim due to his or her possessiveness toward the victim. The stalker may try to get revenge on the victim if the victim broke off the relationship. The stalker may also get jealous if the victim enters into a new relationship. This type of stalker may try to physically harm the victim or the victim’s new partner. • Resentful stalker: A resentful stalker is a person who wants to take revenge on the victim for upsetting him or her. This stalker can be real or imaginary. This type of stalker usually wants to frighten the victim, but he or she may go to great lengths to take revenge on the victim. • Predatory stalker: A predatory stalker is a person who wants to physically or sexually attack the victim. This type of stalking is least common, but these predators are harmful. Though they do not always come in direct contact with the victim, they often contact the victim through e-mails, phone calls, or some other means, and use abusive language to scare the victim. This type of stalker often performs voyeurism or fetishism. The victim may be a known person or a complete stranger. • Intimacy seeker: An intimacy seeker is trying to establish an intimate relationship with the victim. This type of stalker believes that the victim is the right person for him or her and may even think that he or she is in love with the victim. Even when the stalker gets a negative response from the victim, he or she will try to impress the victim through unwelcome messages, letters, phone calls, and gifts. • Incompetent suitor: An incompetent suitor is a suitor who desires a physical or intimate relationship with the victim. This type of stalker asks for dates, calls, or sends messages to the victim, despite being rejected. Incompetent suitors are not harmful and will often quit stalking if threatened or if legal action is taken against them. They stalk the victim for a shorter period of time when compared to other types

10-6

Chapter 10

of stalkers. For them, it is just fun, and it is likely that they have stalked many others in the past and will stalk more in the future. • Erotomaniac and morbidly infatuated stalker: An erotomaniac and morbidly infatuated stalker is a stalker who believes that the victim is in love with him or her, even though the victim has not made any such statement. This type of stalker may experience acute paranoia and delusions. He or she imagines romance with the victim and expects the same from the victim. This type of stalker can be stopped by treating him or her psychologically with drug and talk therapy treatment. • Cyberstalker: Stalkers who try to stalk the victim via electronic media such as the Internet and computer spyware are called cyberstalkers. They may expose or mask their identity to gain the confidence of the victim; then they may try to get information such as contact details by joining the victim in places he or she visits on the Internet.

Stalking Behaviors The following are some behaviors that can be attempted by a stalker: • Unwelcome phone calls • Sending text messages, e-mails, or personal letters • Threatening the victim in order to gain attention • Sending romantic or porn-related gifts to the victim • Multiple perpetrators’ involvement (gang stalking) • Forcing the victim via threatening • Insulting the victim

Stalking Effects A victim may face many problems due to stalking. A victim often finds it hard to perform his or her daily activities due to the irritation and frustration caused by the stalking. The following are some effects of stalking: • Increased absenteeism at work: If the stalker is a coworker or a superior, the victim may be frequently absent from work to avoid the stalking. • Declined performance: Due to tension, irritation, and frustration, the victim may lose concentration at work; hence, the victim’s performance may decline. • Humiliation and becoming the subject of gossip: In the workplace, personal matters often do not remain private. Gossip about stalking can spread quickly, and this can humiliate the victim. • Loss of job, reference, or career of the victim: Often, a victim will choose to leave an organization rather than continue to tolerate stalking. If the victim does not prove that he or she is being stalked, it may be difficult for him or her to get a reference. • Forced relocation: A victim may be forced to relocate to keep himself or herself away from a stalker. • Depression, panic, headaches, sleeplessness, and anger: These are the physical effects that a victim undergoes.

Guidelines for Stalking Victims The following are some guidelines that stalking victims should follow: • • • • • • • • •

Use a private post office box to keep your residential address confidential Obtain an unlisted phone number Ensure that your phone number is not printed on your checks Never use a personal phone number in an e-mail signature Use caller ID Protect your Social Security number Maintain a log of every stalking incident Change your e-mail address if a stalker is using it to make contact Report stalking incidents to the police

Complaint Procedures

10-7

Responsibilities of Supervisors Supervisors should do the following to attempt to curb sexual harassment: • Establish a code of conduct for the employees in the company or organization and make sure that everyone follows it. • Recognize the misconduct of an employee toward a fellow employee and handle the problem in an effective way. • Create a work environment that is safe and secure. • Address the problems of employees in the early stages and document each and every problem properly. This prevents further harassment. • Encourage upward communication among the employees. • Report the complaint through internal supervisory channels so that the complaint is kept confidential. • Take any complaint seriously. • Investigate the complaints that are received and ensure that they are addressed. • Take disciplinary action against employees who violate the sexual harassment policy. • Take punitive action against the culprit if the investigation proves the offender guilty. • Take necessary measures to prevent sexual harassment in the future. • Conduct awareness programs or periodic training for all employees on sexual harassment so that employees are aware of how to maintain discipline and follow a certain code of conduct in the organization.

Responsibilities of Employees Employees should do the following to prevent sexual harassment: • Recognize that sexual harassment is a crime. • Recognize the liability of the company. • Motivate other employees to be aware of sexual harassment and create a complaints committee. • Formulate an anti–sexual harassment policy or develop complaint procedures, such as the following: • A clear statement should be made concerning the commitment to a workplace free of unlawful discrimination and harassment. • A statement should be made that the harasser will be subject to disciplinary action if he or she is found guilty after the investigation. • The complaints committee should ensure that the harasser is penalized. • The complaints committee should ensure that the victim and witnesses are protected from the harasser through confidentiality. • Follow the working policies that are set by the supervisor. • Discuss and publish the policies with newly recruited employees and existing employees. • Avoid participating in or encouraging activities that are perceived as sexual harassment. • Condemn the behavior of the harasser. • Do not give a response to the harasser’s excuses. • Keep track of all the records (letters, e-mails, notes, or documents) that the harasser sends. • Give an honest report about the harasser’s acts to a supervisor.

Complaint Procedures The following are the complaint procedures for sexual harassment: 1. Victim prepares a complaint: The victim must document the incident whenever he or she prepares a complaint. The report should contain the name of the respondent. It should also include the date, time, place, and details of the harassment. The victim should prepare an unbiased and confidential report.

10-8

Chapter 10

2. Victim files the complaint: Before submitting the report to the supervisor, the victim must ensure that he or she has his or her own copy. The victim must record all the documents, notes, e-mails, and letters that are related to the complaint. 3. Victim transmits the complaint to the supervisor: While transmitting the complaint to the supervisor, the victim must ensure that it is kept confidential. The victim must not let the harasser convince him or her not to transmit the complaint. The victim must think in a positive way and believe that the supervisor will help him or her in this situation. 4. Supervisor reviews the complaint: The supervisor reviews the complaint and hands it over to the investigator. 5. Supervisor informally resolves the complaint: If the complaint proves to be confidential, the supervisor accepts the complaint. Later, he or she takes disciplinary action against the harasser.

Investigation Process The following steps are carried out while investigating sexual harassment cases: 1. Choose an investigator who has in-depth knowledge of sexual harassment and who can keep all information confidential. 2. The investigator must be fair while carrying out the investigation. 3. The investigator must acknowledge the receipt of the complaint. 4. The investigator must have the following documents relevant to the incident: a. Policies and complaint procedures b. Files that are related to the alleged victim and alleged harasser c. Incidents that are related to past complaints against the harasser d. State or federal laws 5. The investigator must know the relevant work rules, so that he or she focuses on the facts obtained from the investigation. These may lead to proof of the violation. 6. The investigator interviews all the witnesses and collects the evidence related to the incident. 7. The investigator reviews the findings of the investigation with the victim and the alleged harasser. 8. The victim explains the nature of the complaint so that the investigator can understand the major factors of the complaint. 9. The investigator is given a chance to respond to the victim’s evidence and to bring his or her own evidence. 10. The investigator must document everything carefully, including interviews with the witnesses and the complainant. 11. The investigator consults counsel if he or she has any doubts regarding the incident or how to proceed further during the investigation. 12. When the investigation is completed, the investigator forwards the documents that he or she has made to the supervisor or to decision makers.

Sexual Harassment Investigations The following is a checklist for sexual harassment investigations: • Preliminary considerations • Use two investigators, if possible. • Create a confidential file. • Conduct interviews in a private room. • Gathering the facts • Review the relevant personnel files and company policies. • Interview the victim. • Take the complaint seriously.

Preventive Steps

10-9

• Explain the investigation and promise complete confidentiality. • Find out what happened. • Find out the effects of the harassment on the victim. • Find out the names of witnesses. • Ask the victim what he or she wants. • Assess his or her credibility. • Take a statement, if warranted. • Type the notes of the interview. • Interviewing the perpetrator • Explain the purpose of the interview. • Identify the victim who was harassed by the perpetrator. • Explain the specific basis of the complaint that was lodged. • Ask him or her to respond to the charges. • Interviewing corroborating witnesses • Try to extract information about the perpetrator and identify the victim with the help of witnesses. • Find out what each witness knows. • Differentiate between firsthand and secondhand knowledge. • Assess the credibility of the witness. • Take a statement, if warranted. • Evaluating the facts and making the decision • Evaluate the facts from a reasonable perspective. • Analyze the difference between “unwelcomed” and “voluntary” sexual conduct. • Draft a thorough, even-handed report. • Submit the report to the decision-making official. • Follow up with the victim and perpetrator after the decision has been made.

Sexual Harassment Policy The following are some informal procedures that may be followed in an organization: • The complainant may attempt to resolve the matter directly with the alleged offender and report back to the complaint-receiving official. • The complaint-receiving official may notify the alleged offender of the complaint, paying appropriate attention to the need to maintain confidentiality. • The complainant may also contact the affirmative action officer directly. The following are some formal procedures that may be followed in an organization: • The complainant has the right to file a formal written complaint with the affirmative action officer. • Upon receiving a formal complaint, the affirmative action officer shall inform the alleged offender of the allegation and of the identity of the complainant.

Preventive Steps The following are some steps for preventing sexual harassment: 1. Each and every employee of the organization should be sent a message that harassment shall not be tolerated in the work environment. 2. There should be a written policy prohibiting illegal discrimination by any employee, and any employee who disobeys the rules should be punished appropriately.

10-10

Chapter 10

3. Sexual harassment policies must be discussed at workers’ meetings and at supervisor meetings. 4. Proper guidelines must be displayed to create awareness of the rights of employees to a harassmentfree workplace. 5. Employees must be made aware of problem-solving mechanisms, investigative measures, and grievance and disciplinary procedures used for making decisions on harassment complaints. 6. Supervisors must be aware of organizational policies, enhance their problem-solving skills, check relevant laws, and understand their responsibilities. 7. Employers must conduct awareness programs or periodic training for all employees on sexual harassment so that employees are aware of how to maintain discipline and follow a certain code of conduct in the organization. 8. Employers should assess the work environment for awareness by surveying employees and union members about sexual harassment. 9. Employers should understand and solve the problems of employees who are affected by harassment from outsiders.

U.S. Laws on Sexual Harassment The following are some U.S. laws concerning sexual harassment: • Title VII of the Civil Rights Act of 1964: Title VII prohibits employment discrimination on the basis of race, color, religion, sex, or national origin in hiring, employment (all terms, conditions, and benefits), and termination. • The Civil Rights Act of 1991: This law provides appropriate remedies for intentional discrimination and unlawful harassment in the workplace. • Title IX of the Education Amendments of 1972: This law prohibits sex discrimination of employees and students in educational institutions receiving federal funds. • Equal Protection Clause of the 14th Amendment: This clause creates public institutional liability for institutional sexual harassment of employees, including compensatory and punitive damages. • Common law torts: These laws help identify the common law actions that may be filed by harassed workers. • State and municipal laws: These laws concern rape, sexual abuse, sexual assault, and child molestation.

Title VII of the Civil Rights Act of 1964 Title VII prohibits employment discrimination on the basis of race, color, religion, sex, or national origin in hiring, employment (all terms, conditions, and benefits), and termination. This law applies to businesses with 15 or more employees. The following are some examples of discrimination under Title VII: • Harassing a person because of their friends’, relatives’, or associates’ race, skin color, religion, gender, national origin, age, or disability • Treating people in similar jobs differently • Making assumptions about the abilities of persons based on stereotypes, physical characteristics, or age • Retaliating against a person because a complaint was filed The remedies that are available if a complainant is successful in a Title VII cause of action include reinstatement, back pay, damages for future loss of earnings, emotional pain and suffering, mental anguish, and attorneys’ fees.

The Civil Rights Act of 1991 The Civil Rights Act of 1991 provides for damages in cases of intentional employment discrimination. It establishes private and public liability for the acts of supervisors and employees that constitute sexual harassment of employees. Its purpose is to provide further legislation and clarification of earlier laws concerning sexual harassment.

Australian Laws on Sexual Harassment

10-11

Equal Protection Clause of the 14th Amendment The equal protection clause of the 14th Amendment to the U.S. Constitution prohibits states from denying any person within its jurisdiction the equal protection of the laws. The laws of a state cannot treat any individual differently from another individual in similar conditions and circumstances. This clause creates public institutional liability for institutional sexual harassment of employees, including compensatory and punitive damages.

Common Law Torts The common law torts involved in cyberstalking are torts of invasion of privacy. Cyberstalking is the use of information technology, such as e-mail or the Internet, to repeatedly threaten or harass another individual, group, or organization with false accusations, identity theft, solicitation for sexual purposes, or the gathering of information for further harassment. These common law torts help identify the common law actions that may be filed by harassed workers. The following are the objectives of common law torts: • To identify the tort actions most commonly connected with sexual harassment cases • To explain, in general, the circumstances under which each tort action may be filed • To identify the reasons that harassed workers may choose to file, or to avoid filing, any tort actions • To explain the relationship between sexual harassment law and workers’ compensation

State and Municipal Laws These laws concern rape, sexual abuse, sexual assault, and child molestation. They advise employees of the name, address, and telephone number of each of the state and federal agencies to which inquiries and complaints concerning sexual harassment may be made. The laws set out the deadlines for filing a complaint of sexual harassment with state and federal agencies.

Australian Laws on Sexual Harassment Australia has adopted laws for sexual harassment and discrimination. The following are some laws concerning sexual harassment: • Sex Discrimination Act 1984 • Equal Opportunity for Women in the Workplace Act 1999 • Anti-Discrimination Act 1991 • Workplace Relations Act 1996

Sex Discrimination Act 1984 The Sex Discrimination Act 1984 attempts to eliminate discrimination involving sexual harassment in the workplace, educational institutions, and other public areas. Under this law, it is unlawful for an employee to sexually harass a fellow employee or someone who is seeking to become an employee of the same organization. This law also covers contract workers and employment agents.

Equal Opportunity for Women in the Workplace Act 1999 The Equal Opportunity for Women in the Workplace Act 1999 provides equal rights to women in the workplace. The following are the objectives of the act: • To promote the principle that employment for women should be dealt with on the basis of merit • To promote, amongst employers, the elimination of discrimination against, and the provision of equal opportunity for, women in relation to employment matters

Anti-Discrimination Act 1991 The purpose of the Anti-Discrimination Act 1991 is to promote equality of opportunity for everyone by protecting them from sexual harassment. It prohibits sexual harassment. It also allows someone who has been sexually harassed to make an official complaint.

10-12

Chapter 10

Workplace Relations Act 1996 The Workplace Relations Act 1996 says that rewards shall not be given out based on sexual preference. It orders equal remuneration for men and women workers for work of equal value. It eliminates sex-based discrimination in the workplace.

Indian Law: Sexual Harassment of Women at Workplace (Prevention, Prohibition, and Redressal) Bill, 2006 This law states that it is mandatory for every workplace and every employer to have an internal complaints committee, either in each branch or at the head office. The following are some of the provisions for an internal complaints committee: • An internal complaints committee must have at least three members. • The committee must be headed by a woman. • No less than half of its members must be women. • All members of the complaints committee must be neutral and unbiased. The law ensures an environment free from sexual harassment. Organizations must lay down a clear policy concerning the prevention and prohibition of sexual harassment, and this policy must be prominently displayed. This act also protects complainants from retribution and from attempts to get him or her to change his or her testimony or retract the complaint.

German Law: Protection of Employees Act This law protects employees against sexual harassment, among other things. It establishes an employee’s right to complain, and it spells out measures that an employer or manager can take against a harasser. It also describes further training regarding sexual harassment that those employed in the public service can take.

U.K. Law: The Employment Equality (Sex Discrimination) Regulations 2005 The purpose of the Employment Equality (Sex Discrimination) Regulations 2005 is to eliminate sexual discrimination. The law contains provisions pertaining to sexual harassment. It prohibits both major types of sexual harassment in the workplace.

Law of the People’s Republic of China on the Protection of Rights and Interests of Women This law’s intent is to protect women. It prohibits sexual harassment against women. It also spells out the rights of a woman who is being sexually harassed. A female victim has the right to file a complaint if she is being sexually harassed. The perpetrator can also be tried in both civil and criminal court cases.

Malaysian Penal Code, Section 509 The Malaysian penal code spells out the punishment for sexual harassment against women. This punishment is imprisonment for up to 5 years, a fine, or both.

Sample Complaint Form Figure 10-2 shows a sample sexual harassment complaint form.

Sample Complaint Form

Figure 10-2

This is a sample sexual harassment complaint form.

10-13

(continues)

10-14

Chapter 10

Copyright © by All rights reserved. Reproduction is strictly prohibited

Figure 10-2

This is a sample sexual harassment complaint form. continued

Review Questions

10-15

Laws against Stalking Stalking is a crime and the victims of it are supported by the following laws: • Federal laws • 18 USC § 2261A: The Interstate Travel to Commit Domestic Violence law protects victims whose spouses or intimate partners travel across state lines with the intent to injure, harass, or intimidate the victim and actually cause bodily harm to the victim. • 42 USC §§ 3796gg, 14031: These laws authorize grants for law enforcement agencies to develop programs addressing stalking and for states to improve the process for entering stalking-related data into local, state, and national crime information databases. • California laws • Penal code 646.9: This law defines a stalker as someone who willfully, maliciously, and repeatedly follows or harasses the victim and who makes a credible threat with the intent to place the victim or victim’s immediate family in fear for their safety. The victim does not have to prove that the stalker had the intent to carry out the threat.

Chapter Summary ■

Sexual harassment is a kind of sexual behavior that is offensive and may cause harm to the victim physically, psychologically, and materially because such behavior is against the consent of the victim.

■

Sexual harassment is of two basic types: verbal and physical.

■

The investigator must be impartial and open-minded throughout the entire investigative process.

■

After the completion of the investigation, the documents the investigator made are forwarded to the supervisor or to decision makers.

■

Sexual harassment must be discussed at workers’ meetings and at supervisor meetings.

■

An organization needs to conduct awareness programs or periodic training for all employees on sexual harassment so that employees are aware of how to maintain discipline and follow a certain code of conduct in the organization.

Review Questions 1. What is sexual harassment? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 2. What are the consequences of sexual harassment? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 3. Write down the procedure to issue a complaint against sexual harassment. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 4. Explain the sexual harassment investigative process. ___________________________________________________________________________________________ ___________________________________________________________________________________________

10-16

Chapter 10

5. What are the responsibilities of supervisors? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 6. List the checklist for investigations into sexual harassment. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 7. What are the preventive steps against sexual harassment? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 8. What are the U.S. laws concerning sexual harassment? ___________________________________________________________________________________________ ___________________________________________________________________________________________ 9. What is stalking? Describe the various types of stalkers. ___________________________________________________________________________________________ ___________________________________________________________________________________________ 10. List the laws against stalking. ___________________________________________________________________________________________ ___________________________________________________________________________________________

Hands-On Projects 1. Perform the following steps: ■

Go to http://www.usdoj.gov/criminal/cybercrime/cyberstalking.htm.

■

Read the 1999 report on cyberstalking.

2. Perform the following steps: ■

Go to http://kansascity.fbi.gov/dojpressrel/pressrel09/kc010709.htm.

■

Read the press release from January 7, 2009, about the Kansas City man who pled guilty to cyberstalking charges.

3. Read more about cyberbullying at http://www.ojp.gov/cds/internet_safety/NCPC/Stop%20 Cyberbullying%20Before%20It%20Starts.pdf.

11

Chapter

Investigating Child Pornography

Objectives After completing this chapter, you should be able to: • • • • • • • • • • • • • •

Define child pornography Understand people’s motives behind child pornography Know what kinds of people are involved in child pornography Understand the role of the Internet in promoting child pornography Describe the effects of child pornography on children Describe the measures to prevent dissemination of child pornography Understand the challenges in controlling child pornography Enumerate the steps for investigating child pornography cases Understand the sources of digital evidence Understand the techniques to reduce the problem of child pornography Understand the guidelines to avoid child pornography Understand the laws against child pornography List the anti-child-pornography/organizations Know how to report on child pornography

Key Terms an obscene visual depiction of any kind involving a minor engaging in, or appearing to engage in, sexually explicit conduct, graphic bestiality, sadistic or masochistic abuse, or sexual intercourse of any kind; child pornography also includes the production, distribution, and possession of pornographic material

Child pornography

11-1

11-2

Chapter 11

Introduction to Investigating Child Pornography Child pornography is a serious crime. There are a growing number of children who access the Internet all over the world. Rapidly expanding computer technology and the Internet have facilitated the production and distribution of child pornography. Child pornography is an obscene visual depiction of any kind involving a minor engaging in, or appearing to engage in, sexually explicit conduct, graphic bestiality, sadistic or masochistic abuse, or sexual intercourse of any kind. Child pornography also includes the production, distribution, and possession of pornographic material. As children spend more and more of their time on the Internet, they are increasingly falling prey to child abusers and pornographers. Child pornography begins with the production of pornographic materials such as images and videos. Offenders enter into correspondence with children through online instant messaging or chat rooms. They emotionally attract the prospective victim and befriend him or her. After establishing a steady relationship, they introduce children to pornography by providing images and videos that have sexually explicit material. Pornographers also make use of poor children, disabled minors, and sometimes neighborhood children for sexual exploitation. Even infants have become victims of these activities. Distribution of porn material is also a serious crime. The Internet has made the distribution of illegal material easy. Pornographers resort to newsgroups, Internet Relay Chat (IRC), Web-based groups, e-mail, Webcams, and peer-to-peer technology to distribute pornographic material. Downloading these materials is also considered a crime. This chapter focuses on child pornography and the steps involved in investigating child pornography cases.

People’s Motives Behind Child Pornography Criminals involved in pornographic cases tend to be unmarried, separated, divorced, or widowed. They become involved with child pornography because of various factors. These factors could range from mere moneymaking to sexual perversion. They draw children into pornographic activities by using the following tactics: • Seduction: They offer children something enticing. • Coercion: They force children into sexual activities or threaten them with dire consequences. • Payment: They offer monetary benefits to attract children. • Solicitation: They request a sexual relationship with the children. • Blackmailing: The offenders lure or force children or teenagers into offensive activities and make videos and images of them. Later, they blackmail the victims or their parents by threatening to expose the images or videos. Voyeurism is another motive behind child pornography. This involves people who derive sexual pleasure by secretly watching sexual activities or others in the nude. Offenders often sell pornographic material to make easy money. They also build their own Web sites that provide pornographic materials for money.

People Involved in Child Pornography People involved in child pornography either directly or indirectly are also involved with child abuse. It involves people who enter into online relationships with children. These people attract victims for sexual activities or send pornographic materials to children as part of the grooming process. They contact children using online messaging or chat rooms. This is considered direct abuse of children. For such people, the main intention is to satisfy their sexual curiosity. They also make pornographic images or videos for their own satisfaction. Production of pornographic material is also a serious crime. A person who produces pornographic images or records the sexual activities of children is considered a pornographer. A person who provides sources of child pornography is also included in such an offense. Such offenses are indirect abuse of children. These people may distribute pornographic materials through e-mail, Webcams, or chat rooms. People who intentionally download pornographic material from the Internet and save it to their computer also fall into the category of pornographer. They may not have any intention of abuse and may not be related to other offenders; they download it for pleasure. Parents or guardians who allow their children to engage in pornographic activity are also considered offenders.

Measures to Prevent Dissemination of Child Pornography

11-3

Role of the Internet in Child Pornography The Internet is a fast communication vehicle providing a number of online services. This growing facility helps children learn. Yet, with the increase in access, there has been a rise in Internet crimes. The Internet plays an important role in child pornography cases. Through the Internet, it is easy to access a huge quantity of pornographic material. The Internet provides complete anonymity and privacy. It reduces the cost of production and distribution of such material. The offender distributes the material easily with Web services such as e-mail, newsgroups, and Webcams. An offender can create his or her own Web site and upload the pornographic material, so that others can easily download it. Using an Internet facility such as a Webcam, he or she can send real-time pornographic pictures or video. The most frequent source for distributing pornographic material is e-mail. Offenders can send images or videos as attachments. Offenders can also use e-mail for grooming or seduction purposes. The Internet is the least-expensive method for transferring pornographic materials. The most advantageous factor about the Internet is that the offenders can access pornographic material anytime and anywhere. The Internet enables them to send the images or videos in any format. These files can be stored easily on any digital device, such as a mobile phone or a PDA.

Effects of Child Pornography on Children Child pornography affects children physically, socially, and psychologically. Molestation can cause physical injuries such as genital bruising and lacerations. In many cases, teenagers may experience negative effects later in life due to inappropriate early sexual experiences. Child pornography also gives rise to sexually transmitted diseases. Child pornographic victims also suffer from psychological trauma, such as depression, anger, and schizophrenia. Female victims may suffer from higher rates of nightmares, back pain, headaches, pelvic pain, and other similar symptoms in their adult age. Pornography may cause sexual addiction, which may further result in prostitution or teenage pregnancy. A victim may also lose his or her mental balance and become suicidal.

Measures to Prevent Dissemination of Child Pornography Computer Industry Self-Regulation (Role of ISP) An ISP (Internet service provider) plays an important role in reducing the problem of child pornography. It is necessary for an ISP to take some self-regulatory actions, including the following: • Block illegal sites: It is important that various ISP associations come together and make a decision to block illegal sites. • Use browser filters and search engines for safe search: ISPs can use browser filters to help block sites containing words related to pornography and use filters on search engines so that they will not search illegal sites or images. • Establish complaint sites: ISPs should open sites that will help people complain about pornography hosted on the ISPs servers. The ISPs may deal directly with the police or any other authority.

Legislative Regulation It should be mandatory for ISPs to inform the police about illegal sites. ISPs should have to verify the identities of people who access the Internet. ISPs should confirm the age of the account holder and restrict children from opening an account without adult supervision. Advertisers should not advertise illegal sites.

Citizens’ Committee A citizens’ committee can help control child pornography. This is an organization that creates awareness among the public about such issues and provides community members with a forum in which to voice their complaints about such activities. The committee may provide information to parents and teachers through their sites or publications about the problem of child pornography and how to tackle the issue.

11-4

Chapter 11

Parental Strategies Parents play an important role in protecting children from child pornography. They should restrict their children from accessing such materials. They should use filtering software to protect their children from any indecent material.

Law Enforcement Responses (Role of Police) Police play a crucial role in investigating pornographic sites. The police may use computer forensic tools and techniques to investigate such sites. They may scan the ISP’s servers and request the ISP to remove illegal sites. The police may perform sting operations to investigate suspected offenders. They may make contact with suspects through chat rooms, newsgroups, or other electronic means and disguise themselves as teenagers. Police may also use honeytrap sites to find offenders. These sites contain pornographic material, but they note the IP address or the credit card number of a criminal who tries to download pornographic material from these sites.

Challenges in Controlling Child Pornography The following are some of the challenges involved in controlling child pornography: • Large amount of Internet traffic: The Internet is the network of networks; it provides a fast and easy way for disseminating information. If an ISP blocks a site, there may be other ways to reach the site or another site may spring up containing the same pornographic material. • Unclear jurisdiction due to anonymity of offenders: Criminals from any corner of the world can send or use pornographic material. Laws differ from country to country, which adds to the difficulty of tracking the offender. For example, in the United States, a child is defined as a person who is younger than 18 years of age, but in Australia, a child is defined as a person who is younger than 16 years of age. An offender may produce the pornographic material in one country and distribute it in another country. This raises questions about who will investigate the crime and under which country’s laws the offender will be prosecuted. • Lack of laws and regulations: Another challenge in controlling child pornography is the lack of laws and regulations in certain countries. In most countries, there are no laws against child pornography, so offenders can easily produce the pornographic material in those countries and distribute it through the Internet all over the world. • Sophistication and use of Internet technology by offenders: Due to sophisticated Internet technologies, it is difficult to track offenders. Offenders use various techniques such as e-mail, Webcams, chat rooms, and newsgroups to distribute the materials. With the Internet, it is easy to access a number of pornographic materials. The Internet provides complete anonymity and privacy, which causes a problem during investigation.

Precautions Before Investigating Child Pornography Cases Investigators should take the following precautions before investigating a child pornography case: • Ensure that they have authorization to investigate the child pornography case. • Be familiar with local laws related to child pornography. • Document each step of the investigation in detail. • Request assistance from at least two authorized persons.

Steps for Investigating Child Pornography The following are the steps an investigator should follow when investigating child pornography cases: 1. Search and seize all computers and media devices. 2. Check authenticated login sessions.

Steps for Investigating Child Pornography

11-5

3. Search hard disks for pornographic material. 4. Recover deleted files and folders. 5. Check metadata of files and folders related to pornography. 6. Check and recover browser information. 7. Check ISP logs.

Step 1: Search and Seize All Computers and Media Devices The following are the steps an investigator should follow to search the files on computers and media devices for evidence: 1. Search the files and folders of the suspect’s system for pornographic material. 2. Look for pornographic material on media devices such as USB drives, CD-ROMs, and DVDs. 3. Document and seize the collected evidence carefully.

Step 2: Check Authenticated Login Sessions The following are the steps an investigator should take when checking authenticated login sessions: 1. Check the login information, as user accounts are password protected. 2. Check under which account the pornographic material was accessed. 3. Check whether the user who accessed the pornographic material is an authenticated user, a guest, or an administrator.

Step 3: Search Hard Disks for Pornographic Material The investigator should do a thorough search for pornographic material on suspects’ hard disks. The following are areas the investigator should look in: • Files and folders • Applications • Temporary Internet files • Recycle Bin Tools like SurfRecon scan systems for pornographic material (on hard disks as well as in the browser cache).

Step 4: Recover Deleted Files and Folders The suspect may have deleted the pornographic material from the system. To recover files and folders, even when they have been deleted from the Recycle Bin, an investigator can use tools such as the following: • File Recover • Data Recovery Wizard (Figure 11-1) • PC Inspector File Recovery (Figure 11-2)

Step 5: Check Metadata of Files and Folders Related to Pornography The metadata associated with files and folders is the information concerning when the file was created, modified, or deleted. This information allows the investigator to know when the material was accessed. The investigator should do the following: • Check the metadata of files and folders that contain pornographic material, as shown in Figure 11-3. • Check the metadata of files and folders in the Recycle Bin.

11-6

Chapter 11

Figure 11-1 Data Recovery Wizard allows investigators to recover files a suspect has deleted.

Figure 11-2 PC Inspector File Recovery can recover deleted files, even when the suspect has emptied the Recycle Bin.

Steps for Investigating Child Pornography

11-7

Figure 11-3 Investigators should look at the metadata for a suspect folder, including the folder’s creation date.

Step 6: Check and Recover Browser Information The investigator should check and recover the browser information, which includes the following: • Browsing history • Download history • Cache • Cookies • Offline Web site data • Saved passwords • Authenticated sessions • Saved forms • Search history

Browsing History, Saved Forms, and Search History Most browsers allow users to access the browsing history. In most browsers, a user accesses the browsing history by pressing ctrl+H. The investigator should check the browsing history for any sites that contain pornographic materials. The search bar in browsers often has an automatic completion feature, so an investigator can start typing in key words and phrases relating to child pornography to see if the suspect searched for these terms. The investigator can also search the history itself, as shown in Figure 11-4. Many browsers also offer a URL suggestion feature, so the investigator can start typing in a suspected URL to see if the suspect visited that site. Once a site is found, the investigator can check to see if the suspect saved any form data for that site. This will let the investigator know that the suspect used that particular site.

11-8

Chapter 11

Figure 11-4 Investigators can search the browser history on a suspect computer to see if the suspect has visited any child pornography sites.

Figure 11-5 Investigators can look at the download history in a suspect’s browser to see if he or she has downloaded any child pornography.

Download History Download history is one of the features of most Internet browsers. It shows what files were downloaded and where the downloaded files were saved. To view the download history in Firefox on a Windows system, a user can either select Tools and then Downloads, or just press Ctrl+J. Though users tend to clear the download history regularly, any files that do show up in the list could be useful as evidence. Figure 11-5 shows the download history window in Firefox.

Cache The browser cache is a collection of Web page copies stored on the system’s hard disk or in its volatile memory. Most browsers allow the user to specify the size of the cache. The user can also manually clear the cache. The investigator can search for information in the browser cache. If the cache has been cleared, the investigator can use tools to view the files in which the browser cache is stored to see if there are any traces of important information.

Cookies A cookie is a piece of information that a Web site stores on a user’s system. Most browsers allow users to view these cookies. Figure 11-6 shows the button in Firefox that allows users to view cookies. Viewing the cookies allows the investigator to see what sites have stored cookies on the system. These are sites that the suspect has visited, possibly frequently. Figure 11-7 shows the cookie viewer in Firefox.

Steps for Investigating Child Pornography

Figure 11-6

Users can view the cookies that Web sites have stored on their computers.

Figure 11-7

Investigators can use cookies to see what sites a suspect has visited.

11-9

11-10

Chapter 11

Saved Passwords Most modern browsers give users the option to store passwords used on Web sites. Viewing these passwords allows the investigator to see the URLs of the sites, usernames and passwords, as shown in Figure 11-8.

Authenticated Sessions An authenticated session is the use of the correct username and password for a particular site. Sites often allow users to save their login information for future visits. If an investigator visits a suspected site, he or she can see that the suspect has been there before if the authentication information has been saved. Figure 11-9 shows a site that allows a user to save login information.

Figure 11-8 Many browsers allow users to save passwords, giving investigators evidence they can use during an investigation.

Figure 11-9 Many sites allow users to save their authentication information for future visits.

Guidelines to Avoid Child Pornography on the Web

11-11

Step 7: Check ISP Logs ISP logs contain all Internet activity information that Internet service providers save. They are the logs of the users’ visited Web pages. It can be difficult for an investigator to extract information from these logs for the following reasons: • Some ISPs refuse to show their logs in order to maintain user privacy. • Even when ISPs release their logs, investigators may find it difficult to extract the required information from the huge amount of log data. ISP logs can reveal whether any users that the ISP serves have visited a site that police have identified as a child pornography site.

Sources of Digital Evidence The following are some of the sources of evidence that play an important role during an investigation: • Offender’s computer: The offender’s computer is the main source of evidence during the investigation of child pornography cases. Any pornographic material stored on the offender’s computer is important evidence for the investigation. Log files show detailed information about who logged on to the computer and when. Web browser history shows the online activities of the criminal. E-mail and chat logs constitute an online communication record of the offender. • Handheld devices: Offenders may also use handheld devices for child pornography. They may use devices such as PDAs and mobile phones with digital cameras to record offensive pictures and transmit digital images. Therefore, these devices are also important in an investigation. • Servers: Servers may also play an important role in an investigation. For example, an ISP authentication server records a customer’s information, including the IP address that can be used to identify the user. FTP and Web servers are generally used for uploading and downloading files; these servers record details about what files are uploaded or downloaded, and they also keep track of the IP addresses of users who connect to the servers.

Citizens’ Responsibility in Fighting Against Child Pornography Citizens have a responsibility to act against child pornography to try to eradicate it completely. The following are some ways that citizens can fight against child pornography: • Protest against child pornography Web sites. • Provide information about the impact of pornography on children. • Take initiatives to cease child pornography on the Web. • Report to anti-child-pornography organizations about any child pornography sites. • Block credit card transactions that are requested for child pornography. • Ask ISPs to block the content or URL of a child pornography site.

Guidelines to Avoid Child Pornography on the Web There are many child pornography sites on the Web. The following are some guidelines for avoiding child pornography on the Web: • Use Internet filters that filter unwanted content on the system: Internet filters are pieces of software that are installed on a system in order to block unwanted content, such as child pornography sites or gambling sites. • Make use of search engines that have built-in filters: Search engines that have built-in filters help a user search safely, as they filter results. For instance, Google’s Safe Search feature filters out any sexually explicit or otherwise unsafe images.

11-12

Chapter 11

• Avoid guesswork for URLs: Many users have a habit of taking a guess about a site’s URL. An incorrect guess can take a user to a pornographic site. • Use proper and appropriate keywords during research: Using inappropriate keywords while doing research can lead users to sites containing child pornography or other inappropriate content. • Avoid clicking on questionable URLs or banners: These may take a user to an unwelcome site.

Guidelines for Parents to Reduce the Risk of Their Children Being Exposed to Child Pornography Parental guidance is the best way to keep children away from child pornography. The following are some guidelines for parents to reduce the risk to their children: • Form a friendly, trusting relationship with the child: If the child is afraid of his or her parents, it is unlikely that he or she will ask for or accept help. The child may also be hesitant about reporting any pornographic sites he or she finds to his or her parents. • Guide the child while he or she is browsing: Parents should teach children how to safely browse the Internet. This includes teaching them about sites to avoid and about how to perform safe searches. • Install filtering software that blocks pornographic sites: There are various Internet filters available that parents can use to block children from accessing the Web sites that parents wish to block. • Promote the use of search engines with safe search: Parents should promote the use of search engines with safe search (such as Google) to keep children away from potentially dangerous sites. • Make the child aware of the prevalence of child pornography on the Internet: Parents should explain to their children in detail about how easy it is to be exposed to child pornography on the Internet, even accidentally. Parents may even want to familiarize their children with the laws concerning child pornography. • Assist the child with various anti-child-pornography organizations: It is the duty of parents to inform their children about whom to approach and how to report illegal sites that children might come across. • Use monitoring software: Parents should use software that monitors and records all Web sites visited by the child, captures and logs the chat conversations of the child, monitors their e-mails, and so on.

Tool: Reveal Reveal allows parents to quickly evaluate the files on a system for the presence of child pornography. It works by comparing each word inside text files against special dictionaries of words commonly used by pedophiles, child pornographers, and other types of criminals. It also searches for image, video, and audio files on a system so parents can review those files for objectionable content.

Tool: iProtectYou iProtectYou is an Internet filtering and monitoring program that enables users to control when the Internet can be used and which Web sites can be accessed through the computer. iProtectYou is designed for parents who are concerned about the possible detrimental effects of the Internet on the development of their children. iProtectYou is also designed for schools and libraries, so that they can control what is being viewed in public spaces. iProtectYou gives parents several methods for blocking their children’s access to child pornography over the Internet, including the following: • Porn block by word filtering: Parents can prevent access to Web sites that contain certain words or phrases. Parents can either create a list of words or use the list included with the program.

Tool: Web Control for Parents

11-13

Source: http://www.softforyou.com/articles tutorials/porn blockers.html. Accessed 2/2007.

Figure 11-10 can visit.

Parents can use iProtectYou to control which Web sites their children

• Porn block by URL filtering: Parents can block individual Web sites based on their URLs. • Porn block by using the bad-site list: This constantly updated list is made up of thousands of Web sites that contain undesirable content such as pornography. This list is provided with the program. The following are some of the features of iProtectYou: • Restricts family members from visiting Web sites (Figure 11-10) and newsgroups that may contain pernicious information • Blocks e-mails, chat sessions, instant messages, and P2P connections if they contain inappropriate words • Prevents private information from being sent over the Internet • Allows a parent to set a schedule of days and times when online activity is allowed • Limits Internet traffic to a specified amount of data that can be sent or received per user, per day • Allows parents to control the list of programs that can have access to the Internet • Sends notification e-mails with full descriptions of blocked operations and an attached screenshot of the child’s computer • Allows parents to set different levels of restrictions for every member of the family based on maturity, interest, habits, and parental control needs (Figure 11-11)

Tool: Web Control for Parents Web Control for Parents is a parental control tool, developed specially for protecting children from forbidden materials such as pornography, online gambling, and online drug information. It allows parents to view what Web sites their children visited and block any that the parents find objectionable. Figure 11-12 shows a screenshot from Web Control for Parents.

11-14

Chapter 11

Source: http://www.softforyou.com/articles tutorials/porn blockers.html. Accessed 2/2007.

Figure 11-11 Parents can create users or groups and then assign different restrictions for each user or group.

Source: http://www.download.com/WUPC-Web-Control-for-Parents/3000-2311 4-10529193.html. Accessed 2/2007.

Figure 11-12 Web Control for Parents allows parents to view what Web sites their children visited.

Tool: ChatGuard

11-15

Tool: BrowseControl BrowseControl controls access to the Internet and blocks the usage of certain applications. Parents can also use it to block access to floppy disks, CD drives, and USB drives. The following are some of the features of BrowseControl: • It can completely block Internet access. • It allows access only to Web sites parents specify. • It allows parents to schedule times when children can access the Internet. • It can block the use of different protocols and ports. Figure 11-13 shows a screenshot from BrowseControl.

Tool: ChatGuard ChatGuard is software developed to protect children from online sexual solicitation. It monitors the following: • Internet activity, including the following: • Chat sessions • Sites visited • E-mails • Games and audio • Desktop enhancements Figures 11-14 and 11-15 show screenshots from ChatGuard.

Source: http://www.browsecontrol.com/overview.html. Accessed 2/2007.

Figure 11-13 BrowseControl allows a user to monitor and control access to the Internet.

11-16

Chapter 11

Source: http://www.chatprotection.com/. Accessed 2/2007.

Figure 11-14

ChatGuard allows parents to view logs of their children’s chat sessions.

Source: http://www.chatprotection.com/. Accessed 2/2007.

Figure 11-15 Using ChatGuard, parents can maintain a list of keywords that they want to watch for in chat sessions.

11-17

Child Pornography Legislation Survey

Tool: Child Exploitation Tracking System (CETS) CETS was developed jointly by Microsoft Canada, the Royal Canadian Mounted Police (RCMP), and the Toronto Police Service. CETS is a software solution that allows different law-enforcement agencies to collaborate. It also provides investigators with a set of software tools they can use when investigating child pornography. The tracking system serves as a repository of information. The software enables police agencies to capture, share, and search information. The following are some of the features of CETS: • CETS enables agencies to avoid duplicating effort. Sharing information over a secure network, officers can match up investigations that reference the same people or online identities. • CETS links and connects criminal behavior online that is difficult for the human eye to see. • Using CETS, police agencies can manage and analyze huge volumes of information in different ways, such as cross-referencing obscure data relationships and using social-network analysis to identify communities of offenders.

Child Pornography Legislation Survey Table 11-1 shows the results of a survey of various countries concerning legislation against child pornography. This table shows that some countries such as Afghanistan, Albania, Bangladesh, India, Pakistan, Thailand, Singapore, and Egypt do not have any laws against child pornography, while countries such as Argentina, Austria, Belgium, Brazil, Canada, France, Germany, Hong Kong, Italy, Japan, New Zealand, Russia, South Africa, the United Kingdom, and the United States have well-defined laws against child pornography.

Country

Legislation Specific to Child Pornography?

Child Pornography Defined?

Includes ComputerFacilitated Offenses?

Includes Simple Possession?

Includes ISP Reporting?

Afghanistan

✕

✕

✕

✕

✕

Albania

✕

✕

✕

✕

✕

Algeria

✕

✕

✕

✕

✕

Andorra

✓

✕

✕

✓

✕

Angola

✕

✕

✕

✕

✕

Antigua & Barbuda

✕

✕

✕

✕

✕

Argentina

✓

✕

✕

✕

✕

Armenia

✓

✕

✓

✕

✕

Aruba

✓

✕

✓

✓

✕

Australia

✓

✓

✓

✓

✓

Austria

✓

✓

✓

✓

✕

Azerbaijan

✕

✕

✕

✕

✕

Table 11-1 This table shows what types of legislation, if any, concerning child pornography that countries around the world have

(continues)

11-18

Chapter 11

Country

Legislation Specific to Child Pornography?

Child Pornography Defined?

Includes ComputerFacilitated Offenses?

Includes Simple Possession?

Includes ISP Reporting?

Bahamas

✕

✕

✕

✕

✕

Bahrain

✕

✕

✕

✕

✕

Bangladesh

✕

✕

✕

✕

✕

Barbados

✓

✕

✕

✓

✕

Belarus

✓

✕

✕

✕

✕

Belgium

✓

✓

✓

✓

✓

Belize

✕

✕

✕

✕

✕

Benin

✕

✕

✕

✕

✕

Bhutan

✓

x

✓

x

x

Bolivia

✕

✕

✕

✕

✕

BosniaHerzegovina

✓

✕

✓

✓

✕

Botswana

✕

✕

✕

✕

✕

Brazil

✓

✕

✓

✕

✕

Brunei

✓

✕

✓

✕

✕

Bulgaria

✓

✕

✓

✓

✕

Burkina-Faso

✕

✕

✕

✕

✕

Burundi

✕

✕

✕

✕

✕

Cambodia

✕

✕

✕

✕

✕

Cameroon

✕

✕

✕

✕

✕

Canada

✓

✓

✓

✓

✕

Cape Verde

✓

✕

✕

✕

✕

Central African Republic

✕

✕

✕

✕

✕

Chad

✕

✕

✕

✕

✕

Chile

✓

✓

✓

✕

✕

China

✓

✕

✓

✕

✕

Colombia

✓

✓

✓

✕

✓

Comoros

✕

✕

✕

✕

✕

Congo

✕

✕

✕

✕

✕

Costa Rica

✓

✓

✕

✕

✕

Côte d’Ivoire

✕

✕

✕

✕

✕

Croatia

✓

✕

✓

✓

✕

Cuba

✕

✕

✕

✕

✕

Cyprus

✓

✕

✓

✓

✕

Czech Republic

✓

✕

✓

✕

✕

Democratic Republic of Congo

✕

✕

✕

✕

✕

Denmark

✓

✓

✓

✓

✕

Table 11-1 This table shows what types of legislation, if any, concerning child pornography that countries around the world have

11-19

Child Pornography Legislation Survey

Country

Legislation Specific to Child Pornography?

Child Pornography Defined?

Includes ComputerFacilitated Offenses?

Includes Simple Possession?

Includes ISP Reporting?

Djibouti

✕

✕

✕

✕

✕

Dominica

✕

✕

✕

✕

✕

Dominican Republic

✓

✕

✕

✕

✕

Ecuador

✓

✕

✕

✕

✕

Egypt

✕

✕

✕

✕

✕

El Salvador

✓

✕

✓

✓

✕

Equatorial Guinea

✕

✕

✕

✕

✕

Eritrea

✕

✕

✕

✕

✕

Estonia

✓

✕

✓

✓

✕

Ethiopia

✕

✕

✕

✕

✕

Fiji

✕

✕

✕

✕

✕

Finland

✓

✓

✓

✓

✕

France

✓

✓

✓

✓

✓

Gabon

✕

✕

✕

✕

✕

Gambia

✓

✕

✕

✕

✕

Georgia

✓

✓

✕

✕

✕

Germany

✓

✓

✓

✓

✕

Ghana

✕

✕

✕

✕

✕

Greece

✓

✓

✓

✓

✕

Grenada

✕

✕

✕

✕

✕

Guatemala

✓

✕

✕

✕

✕

Guinea

✕

✕

✕

✕

✕

Guinea Bissau

✕

✕

✕

✕

✕

Guyana

✕

✕

✕

✕

✕

Haiti

✕

✕

✕

✕

✕

Honduras

✓

✓

✓

✓

✕

Hong Kong

✓

✓

✓

✓

✕

Hungary

✓

✓

✓

✓

✕

Iceland

✓

✕

✓

✓

✕

India

✕

✕

✕

✕

✕

Indonesia

✕

✕

✕

✕

✕

Iran

✕

✕

✕

✕

✕

Iraq

✕

✕

✕

✕

✕

Ireland

✓

✓

✓

✓

✕

Israel

✓

✓

✓

✓

✕

Italy

✓

✓

✓

✓

✕

Jamaica

✕

✕

✕

✕

✕

Table 11-1 This table shows what types of legislation, if any, concerning child pornography that countries around the world have

(continues)

11-20

Chapter 11

Country

Legislation Specific to Child Pornography?

Child Pornography Defined?

Includes ComputerFacilitated Offenses?

Includes Simple Possession?

Includes ISP Reporting?

Japan

✓

✓

✓

✕

✕

Jordan

✕

✕

✕

✕

✕

Kazakhstan

✓

✕

✕

✕

✕

Kenya

✕

✕

✕

✕

✕

Korea

✓

✓

✓

✕

✕

Kuwait

✕

✕

✕

✕

✕

Kyrgyzstan

✓

✕

✕

✕

✕

Laos

✕

✕

✕

✕

✕

Latvia

✓

✕

✓

✕

✕

Lebanon

✕

✕

✕

✕

✕

Lesotho

✕

✕

✕

✕

✕

Liberia

✕

✕

✕

✕

✕

Libya

✕

✕

✕

✕

✕

Liechtenstein

✓

✕

✓

✓

✕

Lithuania

✓

✕

✕

✓

✕

Luxembourg

✓

✕

✓

✓

✕

Macedonia

✓

✕

✓

✕

✕

Madagascar

✓

✕

✓

✕

✕

Malawi

✕

✕

✕

✕

✕

Malaysia

✕

✕

✕

✕

✕

Maldives

✕

✕

✕

✕

✕

Mali

✓

✕

✕

✕

✕

Malta

✓

✕

✓

✓

✕

Marshall Islands

✕

✕

✕

✕

✕

Mauritania

✕

✕

✕

✕

✕

Mauritius

✓

✕

✓

✕

✕

Mexico

✓

✓

✓

✕

✕

Moldova

✕

✕

✕

✕

✕

Monaco

✕

✕

✕

✕

✕

Mongolia

✕

✕

✕

✕

✕

Morocco

✓

✕

✕

✓

✕

Mozambique

✕

✕

✕

✕

✕

Myanmar

✓

✕

✕

✕

✕

Namibia

✕

✕

✕

✕

✕

Nauru

✕

✕

✕

✕

✕

Nepal

✓

✕

✕

✕

✕

Netherlands

✓

✓

✓

✓

✕

Table 11-1 This table shows what types of legislation, if any, concerning child pornography that countries around the world have

11-21

Child Pornography Legislation Survey

Country

Legislation Specific to Child Pornography?

Child Pornography Defined?

Includes ComputerFacilitated Offenses?

Includes Simple Possession?

Includes ISP Reporting?

Netherlands Antilles

✕

✕

✕

✕

✕

New Zealand

✓

✓

✓

✓

✕

Nicaragua

✕

✕

✕

✕

✕

Niger

✕

✕

✕

✕

✕

Nigeria

✕

✕

✕

✕

✕

Norway

✓

✓

✓

✓

✕

Oman

✕

✕

✕

✕

✕

Pakistan

✕

✕

✕

✕

✕

Panama

✓

✓

✓

✓

✕

Papua New Guinea

✓

✕

✕

✓

✕

Paraguay

✓

✕

✕

✓

✕

Peru

✓

✓

✓

✓

✕

Philippines

✓

✕

✕

✕

✕

Poland

✓

✕

✕

✓

✕

Portugal

✓

✕

✓

✕

✕

Qatar

✓

✕

✓

✕

✕

Romania

✓

✓

✓

✓

✕

Russia

✓

✕

✕

✕

✕

Rwanda

✕

✕

✕

✕

✕

St. Kitts & Nevis

✕

✕

✕

✕

✕

St. Lucia

✕

✕

✕

✕

✕

St. Vincent & the Grenadines

✕

✕

✕

✕

✕

Sao Tome & Principe

✕

✕

✕

✕

✕

Saudi Arabia

✕

✕

✕

✕

✕

Senegal

✕

✕

✕

✕

✕

Serbia & Montenegro

✓

✕

✓

✕

✕

Seychelles

✕

✕

✕

✕

✕

Sierra Leone

✕

✕

✕

✕

✕

Singapore

✕

✕

✕

✕

✕

Slovak Republic

✓

✓

✓

✓

✕

Slovenia

✓

✓

✓

✕

✕

Somalia

✕

✕

✕

✕

✕

South Africa

✓

✓

✓

✓

✓

Spain

✓

✕

✓

✓

✕

Sri Lanka

✓

✕

✕

✓

✕

Table 11-1 This table shows what types of legislation, if any, concerning child pornography that countries around the world have

(continues)

11-22

Chapter 11

Country

Legislation Specific to Child Pornography?

Child Pornography Defined?

Includes ComputerFacilitated Offenses?

Includes Simple Possession?

Includes ISP Reporting?

Sudan

✕

✕

✕

✕

✕

Suriname

✕

✕

✕

✕

✕

Swaziland

✕

✕

✕

✕

✕

Sweden

✓

✕

✓

✓

✕

Switzerland

✓

✓

✓

✓

✕

Syria

✕

✕

✕

✕

✕

Tajikistan

✓

✕

✕

✕

✕

Tanzania

✓

✕

✕

✕

✕

Thailand

✕

✕

✕

✕

✕

Timor-Leste

✕

✕

✕

✕

✕

Togo

✕

✕

✕

✕

✕

Tonga

✓

✓

✓

✓

✕

Trinidad & Tobago

✕

✕

✕

✕

✕

Tunisia

✓

✕

✓

✕

✕

Turkey

✓

✕

✕

✓

✕

Turkmenistan

✕

✕

✕

✕

✕

Uganda

✕

✕

✕

✕

✕

Ukraine

✓

✕

✓

✕

✕

United Arab Emirates ✕

✕

✕

✕

✕

United Kingdom

✓

✓

✓

✓

✕

United States

✓

✓

✓

✓

✓

Uruguay

✓

✕

✓

✕

✕

Uzbekistan

✕

✕

✕

✕

✕

Venezuela

✓

✓

✓

✕

✕

Vietnam

✕

✕

✕

✕

✕

Yemen

✕

✕

✕

✕

✕

Zambia

✕

✕

✕

✕

✕

Zimbabwe

✕

✕

✕

✕

✕

Table 11-1 This table shows what types of legislation, if any, concerning child pornography that countries around the world have continued

U.S. Laws Against Child Pornography There are several U.S. laws concerning child pornography. The following sections describe some of these laws.

§ 18 U.S.C. 1466A This law involves the prohibition of the production, distribution, reception, and possession of child pornography. It also defines child pornography under U.S. law as any obscene visual representation of a minor engaging in sexually explicit conduct that lacks serious literary, artistic, political, or scientific value. This law also prohibits the transportation and transmittal of child pornography.

Belgian Laws Against Child Pornography

11-23

§ 18 U.S.C. 2251 The focus of this law is preventing the sexual exploitation of children. It prohibits using, persuading, enticing, or coercing a minor to engage in sexually explicit conduct for the purpose of producing child pornography. It also prohibits parents and legal guardians from knowingly permitting minors to engage in sexually explicit conduct for the purpose of producing child pornography. This law also covers printing, receiving, buying, producing, or exchanging child pornography or advertisements for child pornography.

§ 18 U.S.C. 2252 This law prohibits transporting child pornography by any means, including through electronic media or the postal system. It also prohibits knowingly receiving such material. The law also prohibits selling or possessing any child pornography that has been transported.

§ 42 U.S.C. 13032 The purpose of this law is to spell out the duties of ISPs in reporting child pornography. It also specifies the hefty fines that an ISP must pay if it knowingly and willfully fails to report such a discovery of child pornography.

State Laws: Michigan Laws Against Child Pornography The Child Abuse and Neglect Prevention Act establishes the state Child Abuse and Neglect Prevention Board. It also describes the powers and duties of this board.

Australian Laws Against Child Pornography There are several laws in Australia dealing with child pornography. The following sections describe a pair of laws concerning child pornography sent over computer networks.

Criminal Code Act 1995 Section 474.19 This law prohibits a person from using a computer network to access, transmit, publish, distribute or make available child pornography material. The penalty for violating this law is imprisonment for 10 years.

Criminal Code Act 1995 Section 474.20 This law prohibits a person from possessing, producing, supplying, or obtaining child pornography material for use through a computer network. The penalty for violating this law is imprisonment for 10 years.

Austrian Laws Against Child Pornography One of the major laws concerning child pornography in Austria is Austrian Penal Code § 207a. This law states that anyone who produces, imports, exports, offers, procures, transfers, or makes available child pornography will be sentenced to up to 3 years’ imprisonment. It also spells out further punishments for those who violate the law for financial gain or who violate the law in a way that causes harm to the minor involved. The law also provides a punishment of 1 to 2 years in prison for anyone who possesses child pornography.

Belgian Laws Against Child Pornography The following two sections describe two laws against child pornography in Belgium.

Article 383bis of the Penal Code This law prohibits the display, sale, rental, distribution, manufacture, possession, or import of child pornography. Penalties for violating this law include fines, imprisonment for a month to a year, and forced labor for 10 to 15 years.

Article 380ter of the Penal Code This law prohibits a person from publishing or distributing an offer of services of a sexual nature with a direct or indirect profit-making objective, when the publicity is either specifically addressed to minors or when the

11-24

Chapter 11

services involve minors. It also specifically makes note of this occurring over a telecommunications medium. Those who respond to such advertisements will also be punished.

Cypriot Laws Against Child Pornography There are two major laws against child pornography in Cyprus, and these are covered in the following two sections.

The Convention on Cybercrime, Law 22(III)/2004 This law prohibits the following: • Producing child pornography for the purpose of its distribution through a computer system • Offering or making available child pornography through a computer system • Distributing or transmitting child pornography through a computer system • Procuring child pornography through a computer system • Possessing child pornography in a computer system or on a computer data storage medium

Combating Trafficking in Human Beings and Sexual Abuse of Minors Law 3(1)/2000 This law states that anyone who makes, possesses, carries, imports, exports, publishes, or distributes child pornography will be imprisoned for up to 10 years.

Japanese Laws Against Child Pornography The Law for Punishing Acts Related to Child Prostitution and Child Pornography and for Protecting Children is the major law concerning child pornography in Japan. Article 2 of this law defines child pornography as a visual depiction of the following: • A child posed in such a way that it appears that the child is engaging in sexual intercourse or an act similar to sexual intercourse • A child touching his or her genital organs or the genital organs of another person in order to arouse the viewer’s sexual desire • A child who is naked totally or partially in order to arouse the viewer’s sexual desire Article 7 of this law prohibits the distribution, sale, lending, or display of child pornography. It also prohibits the production, possession, transportation, import, and export of child pornography.

South African Laws Against Child Pornography There are several South African laws concerning child pornography. These are described in the following sections.

Child Care Amendment Act This act prohibits the commercial sexual exploitation of children. It also establishes secure care facilities for children. Section 50A of this act says that anyone who participates or is involved in the commercial sexual exploitation of a child will be punished. This section also says that any person who is an owner, lessor, manager, tenant, or occupier of a property where the sexual exploitation of a child occurs and who learns of this occurrence must report it to the police or else that person will also be punished.

Amendment of Section 2 of Act 65 of 1996 This amendment prohibits the creation, production, possession, and distribution of child pornography. It specifically mentions the Internet as a prohibited distribution medium.

Scottish Laws Against Child Pornography

11-25

Amendment of Section 27 of Act 65 of 1996 This amendment prohibits the creation, production, import, and possession of child pornography.

U.K. Laws Against Child Pornography The Sex Offences Act 2003 is the major piece of legislation concerning child pornography in the U.K. The following sections describe sections of this law that deal with child pornography.

Section 15 This section concerns meeting a child following sexual grooming. A person violates this law if he or she has communicated with a minor at least twice and then meets or intends to meet with that minor to engage in sexual activity.

Section 16 This section concerns inappropriate touching. A person violates this law if he or she intentionally touches a minor in a sexual manner.

Section 17 This section states that a person violates this law if he or she causes or incites a minor to engage in sexual activity.

Section 18 This section states that a person violates this law if he or she knowingly engages in sexual activity in the presence of a minor.

Section 19 This section states that a person violates this law if he or she forces a minor to watch sexual activity.

Section 47 This section states that a person violates this law if he or she pays for the sexual services of a minor.

Section 48 This section states that a person violates this law if he or she causes or incites child prostitution or child pornography.

Section 49 This section states that a person violates this law if he or she controls the action of a minor involved in child prostitution or child pornography.

Section 50 This section states that a person violates this law if he or she arranges or facilitates child prostitution or child pornography.

English and Welsh Laws Against Child Pornography The Protection of Children Act 1978 states that it is an offense for a person to take, or permit to be taken, or to make an indecent photograph of a child. It is also an offense under this law to possess, distribute, publish, or display such photographs.

Scottish Laws Against Child Pornography The Civic Government (Scotland) Act 1982 deals with child pornography. The act prohibits the creation, distribution, possession, publishing, and display of indecent photographs of children.

11-26

Chapter 11

Philippine Laws Against Child Pornography Republic Act 7610—known as the Special Protection of Children against Child Abuse, Exploitation, and Discrimination Act—deals with child prostitution and other sexual abuse. It states that children who are influenced by an adult, syndicate, or group to engage in sexual intercourse for the monetary or profitable gain of the adult, syndicate, or group are deemed to be victims of child prostitution and other sexual abuse. Those who engage in this exploitation are punished under the law. This includes those who coerce the child into performing the sexual activity and those who engage in the sexual activity with the child.

Children’s Internet Protection Act (CIPA) The Children’s Internet Protection Act (CIPA) is a federal law that addresses concerns about access to offensive content over the Internet on school and library computers. CIPA imposes certain types of requirements on any school or library that receives funding for Internet access or internal connections from the E-rate program—a program that makes certain communications technology more affordable for eligible schools and libraries. The following are the requirements of CIPA: • Schools and libraries subject to CIPA may not receive the discounts offered by the E-rate program unless they certify that they have an Internet safety policy and technology protection measures in place. This Internet safety policy must block or filter access to images that are obscene, are child pornography, or are otherwise harmful to minors. • Schools subject to CIPA are required to adopt and enforce a policy to monitor the online activities of minors. • Schools and libraries subject to CIPA are required to adopt and implement a policy addressing access by minors to inappropriate material on the Internet, the safety and security of minors who engage in electronic communications over the Internet, unauthorized access and other unlawful activities by minors online, unauthorized disclosure of personal information regarding minors, and restricting minors’ access to harmful materials online.

Anti-Child-Pornography Organizations Anti-child-pornography organizations are nonprofit organizations established to eradicate child pornography so children can live in a better environment. They accept anonymous and online abuse reports to maintain the privacy of individuals. The following are some of the various anti-child-pornography organizations: • Project Safe Childhood (PSC) • Innocent Images National Initiative (IINI) • Internet Crimes Against Children (ICAC) • Anti-Child Porn Organization (ACPO) • Child Exploitation and Online Protection Centre (CEOP) • Think U Know • Virtual Global Taskforce (VGT) • Internet Watch Foundation (IWF) • International Centre for Missing & Exploited Children (ICMEC) • National Center for Missing & Exploited Children (NCMEC) • CyberTipline • Child Victim Identification Program (CVIP) • Financial Coalition Against Child Pornography (FCACP) • Perverted Justice • National Society for the Prevention of Cruelty to Children (NSPCC) • Canadian Centre for Child Protection (CCCP) • Cybertip.ca

Anti-Child-Pornography Organizations

11-27

• Association of Sites Advocating Child Protection (ASACP) • Web Sites Against Child Porn (WSACP) • Report Child Porn • Child Focus • StopChildPorno.be

Project Safe Childhood Project Safe Childhood (PSC) aims to combat technology-facilitated sexual exploitation crimes against children. Its goals are to investigate and prosecute vigorously, and to protect and assist the victimized children. The organization recognizes the need for a broad, community-based effort to protect children. PSC creates, on a national platform, locally designed partnerships of federal, state, local, and tribal law enforcement officers in each federal judicial district to investigate and prosecute Internet-based crimes against children. With the U.S. Attorney as the convener, each local community is able to design and implement programs that are uniquely tailored to its needs, while maximizing the impact of national resources and expertise. The PSC partnerships in every district aim to address the five major components of the initiative, as follows: 1. Integrated federal, state, and local efforts to investigate and prosecute child exploitation cases, and to identify and rescue child victims: U.S. Attorneys coordinate the investigation and prosecution of child exploitation crimes, and the efforts to identify and rescue victims. 2. Participation of PSC partners in coordinated national initiatives: Child pornography cases are often initiated by law enforcement agents uncovering a peer-to-peer network, server, or Web site. Such national operations may be conducted by the FBI’s Innocent Images Unit, ICE’s Cyber Crime Center, USPIS’s Child Exploitation Task Forces, ICAC task forces, or others. These investigations can lead to hundreds or thousands of leads in communities throughout the country. 3. Increased federal involvement in child pornography and enticement cases: All states have laws in place to respond to child exploitation and abuse, and some states have very significant criminal laws and penalty provisions for child pornography offenders and online sexual predators that parallel or exceed those provided by federal law. However, federal law has some advantages over state law, so PSC strives to get federal prosecutors more involved in these types of cases. 4. Training of federal, state, and local law enforcement: Computer-based crimes present unique challenges for law enforcement. Investigators must be trained and have the necessary equipment to investigate and perform computer forensic analysis of targeted equipment. A key component of PSC is to ensure that federal, state, local, and tribal officers are properly instructed. 5. Community awareness and educational programs: PSC aims to enhance existing efforts to generate awareness and to educate the public about the threats to children and the ways to prevent online exploitation. It partners with existing national programs to raise awareness about the threat of online sexual predators and provide the tools and information to parents and children seeking to report possible violations.

Innocent Images National Initiative The Innocent Images National Initiative (IINI), a component of the FBI’s Cyber Crimes Program, combats child pornography and child sexual exploitation facilitated by an online computer. It provides centralized coordination with state, local, and international governments. It also provides analysis of case information. The following are the main goals of the IINI: • To reduce the vulnerability of children to acts of sexual exploitation and abuse that are facilitated through the use of computers • To identify and rescue witting and unwitting child victims • To investigate and prosecute sexual predators who use the Internet and other online services to sexually exploit children for personal or financial gain • To strengthen the capabilities of federal, state, local, and international law enforcement through training programs and investigative assistance The FBI’s Innocent Images National Initiative focuses on the following: • Online organizations, enterprises, and communities that exploit children for profit or personal gain • Producers of child pornography

11-28

Chapter 11

• Individuals who travel, or indicate a willingness to travel, for the purpose of engaging in sexual activity with a minor • Major distributors of child pornography • Possessors of child pornography The following are some of the areas of the Internet that the IINI investigates: • • • • • • •

Internet Web sites that post child pornography Internet newsgroups Internet Relay Chat (IRC) channels File servers Online groups and organizations Peer-to-peer (P2P) file-sharing programs Bulletin board systems and other online forums

Internet Crimes Against Children The Internet Crimes Against Children Task Force (ICAC) investigates and prosecutes individuals who use the Internet to exploit children. It comprises regional task forces that assist state and local law enforcement develop an effective response to computer-related crimes against children, including child pornography. The following are some of the things the ICAC provides to law enforcement agencies: • • • • • •

Proactive investigations Forensic and investigative components Training and technical assistance Effective prosecutions Victim services Community education

The following are some of the components of the task force’s mission: • To intervene and stop individuals who use the Internet to entice a child to meet with them for sexual purposes • To investigate and prosecute those who possess, create, or distribute child pornography • To educate the public about the dangers that exist for minors on the Internet

Anti-Child Porn Organization The Anti-Child Porn Organization (ACPO) is an organization whose mission is to stop the sexual exploitation of the world’s children. Composed of volunteers from all over the world, ACPO focuses on the issues of child pornography production and distribution via the Internet, as well as the predatory use of the Internet for the sexual abuse of children. The organization’s main goal is to protect children from becoming victims of child pornography and to keep it from spreading over the Internet. Its secondary goal is educating individuals and organizations about the Internet and its associated risks. The ACPO feels it is key to educate both politicians and the public about the danger that child pornographers pose to the collective social interest. The organization also counsels law enforcement agencies on gathering information and evidence related to the Internet. The following are some of the ACPO’s other goals: • To provide a massive amount of information to law enforcement authorities, including activity hot spots on the Internet and the results of the ACPO’s own investigations of the activities of online child pornographers • To halt sensationalism and hype regarding the Internet while promoting quality investigative journalism on pedophile pornography • To create enough public pressure to bring authorities to the point of action • To form a cooperative with other Internet groups with similar goals that will benefit them all and increase their impact

Anti-Child-Pornography Organizations

11-29

How to Report to the Anti-Child Porn Organization About Child Pornography Cases The following is the procedure for reporting child pornography cases to the Anti-Child Porn Organization: 1. Go to http://www.antichildporn.org. 2. Click Report! and then Report Child Porn. 3. A form titled “Anonymous Submission” will appear (Figure 11-16). 4. Give the appropriate Web address or FTP address of the pornographic sites. 5. Write details about those sites. 6. Click Submit.

Child Exploitation and Online Protection Centre Child Exploitation and Online Protection (CEOP) Centre is a U.K.-based anti-child-pornography organization. It focuses on protecting children from sexual abuse. It targets, tracks, and brings offenders or perpetrators to the court of law with the help of local or international forces. Teams consist of police officers, staff members from or sponsored by corporations, and government and corporate experts.

Think U Know Think U Know is the education program of the Child Exploitation and Online Protection Centre aimed at young people. It encourages safe Internet browsing and is based around the following three themes: 1. How to safely have fun 2. How to stay in control 3. How to report a problem

Source: http://www.antichildporn.org. Accessed 2/2007.

Figure 11-16

Users can use this form to report sites containing child pornography.

11-30

Chapter 11

The Web site divides users into the following groups: • Children between 5 and 7 • Children between 8 and 10 • Children between 11 and 16 • Parents or caregivers • Teachers or trainers Figure 11-17 shows the Web site for Think U Know.

Virtual Global Taskforce The Virtual Global Taskforce (VGT) is a group of law enforcement agencies from around the world working together to fight child abuse online. The following are some of the objectives of the VGT: • To make the Internet a safer place • To identify, locate, and help children at risk • To hold perpetrators appropriately to account The VGT is made up of the following agencies: • Australian Federal Police • CEOP Centre in the U.K. • Italian Postal and Communication Police Service • Royal Canadian Mounted Police • U.S. Department of Homeland Security • Interpol The VGT allows users to report abuse online. The user just needs to click the icon Report Abuse, fill in the details, and submit the report. Figure 11-18 shows a screenshot from the VGT Web site.

Source: http://www.thinkuknow.co.uk/. Accessed 2/2007.

Figure 11-17 The Think U Know Web site divides content into different areas for different groups of people.

Anti-Child-Pornography Organizations

11-31

Source: http://www.virtualglobaltaskforce.com/. Accessed 2/2007.

Figure 11-18 Abuse icon.

Users can report abuse on the VGT Web site by clicking the Report

Internet Watch Foundation The Internet Watch Foundation (IWF) is the U.K. hotline for reporting illegal content, specifically acting upon child sexual abuse hosted worldwide, and content, hosted in the U.K., that is criminally obscene or incites racial hatred. Following are the features of the Internet Watch Foundation (IWF) Web site: • Online reporting form: It can be reached from any page of the Web site by clicking on the Report Illegal Content Click Here icon on every page (Figure 11-19). • Links to relevant Web sites: These are shown on every page where needed; this section shows links to the relevant Web sites and document downloads for that page. • Communications: This section is shown on every page; it provides IWF contact details as well as links to the newsletter registration page, the Web site feedback page, IWF literature, and the materials page. • News ticker: It is shown on every page; these scrolling links allow users to access the most recent IWF news stories. • Search function: It is shown on every page; this function allows users to search the IWF Web site using key words and phrases.

International Centre for Missing & Exploited Children The International Centre for Missing & Exploited Children (ICMEC) was founded in 1998. It works to identify and coordinate a global network of organizations fighting the sexual exploitation and abduction of children. It lets people report sites containing child pornography. ICMEC’s work helps children and families by doing the following: • Establishing a global resource to find missing children and prevent the sexual exploitation of children (Figure 11-20) • Creating national centers and affiliates worldwide • Building an international network to disseminate images of and information about missing and exploited children

11-32

Chapter 11

Source: http://www.iwf.org.uk/. Accessed 2/2007.

Figure 11-19 The IWF Web site features a Report Illegal Content Click Here icon on every page to allow users to report illegal Web site content.

Source: http://www.icmec.org/. Accessed 2/2007.

Figure 11-20

One of the goals of the ICMEC is to find missing children.

• Providing training to law enforcement, prosecutors, judges, legal professionals, nongovernmental organizations, and government officials • Advocating and proposing legislative changes in laws, treaties, and systems to protect children worldwide

Anti-Child-Pornography Organizations

11-33

• Conducting international expert conferences to build awareness, and encourage and increase cooperation and collaboration between and among countries • Working alongside financial industry and law enforcement to combat commercial sexual exploitation of children

National Center for Missing & Exploited Children The National Center for Missing & Exploited Children (NCMEC) is a nonprofit anti-child-pornography organization. It helps people report through the CyberTipline about missing children or about sites that are offering child pornography. Figure 11-21 shows the NCMEC’s Web site.

CyberTipline CyberTipline is a reporting mechanism for cases of child sexual exploitation, including child pornography, online enticement of children for sex acts, molestation of children outside the family, sex tourism of children, child victims of prostitution, and unsolicited obscene material sent to a child. Reports may be made 24 hours per day, 7 days per week, online or over the phone. Figure 11-22 shows the CyberTipline Web site.

Child Victim Identification Program The Child Victim Identification Program (CVIP) provides domestic and international agencies with information concerning child pornography cases. It is also the central point of contact for victim identification. CVIP assists law enforcement and prosecution teams with child-pornography evidence reviews in order to help them learn the full range of crimes committed in each case, maximize sentences available for each charge, and attempt to identify the location of unidentified child sexual exploitation victims. It is maintained by the Child Exploitation and Obscenity Section of the U.S. Department of Justice and the National Center for Missing & Exploited Children (NCMEC). Figure 11-23 shows a Web site concerning CVIP.

Financial Coalition Against Child Pornography The Financial Coalition Against Child Pornography (FCACP) is a coalition of credit card issuers, Internet services companies, and other financial and technological organizations that seek to eliminate commercial child pornography by taking action on the payment systems used to fund these illegal operations. The International Centre for Missing & Exploited Children (ICMEC) and National Center for Missing & Exploited Children (NCMEC) formed the coalition. As of 2009, thirty-one companies had joined the coalition. Coalition members proactively look for and report child pornography.

Source: http://www.missingkids.com/. Accessed 2/2007.

Figure 11-21

The NCMEC searches for missing children in the United States.

11-34

Chapter 11

Source: http://www.missingkids.com/cybertip/. Accessed 2/2007.

Figure 11-22 The CyberTipline Web site allows people to report child sexual exploitation online.

Source: http://www.missingkids.com/. Accessed 2/2007.

Figure 11-23

CVIP is the central point of contact for victim identification.

Anti-Child-Pornography Organizations

11-35

Perverted Justice Perverted Justice is a California-based nonprofit organization for investigating, identifying, and publicizing users in chat rooms with predatory tendencies toward children. Its methods are controversial, and a number of critics have termed these actions as harassment. It recruits volunteer contributors who do the following: • Pose as underage children in chat rooms • Use a fake online screen name • Wait for predators to initiate conversations with them

National Society for the Prevention of Cruelty to Children The National Society for the Prevention of Cruelty to Children (NSPCC) protects children from cruelty, supports vulnerable families, campaigns for changes to the law, and raises awareness about abuse. Its aim is to have a society where all children are loved, valued, and able to fulfill their potential. It runs the Child Protection Helpline and the ChildLine in the U.K. and the Channel Islands. Most of its work is with children, young people, and their families. It also works to achieve cultural, social, and political change by influencing legislation, policy, practice, public attitudes, and behaviors. ChildLine is a service provided by NSPCC that is the U.K.’s free, 24-hour help line for children in distress or danger. Trained volunteer counselors comfort, advise, and protect children and young people who may feel they have nowhere else to turn. NSPCC has set the following four objectives: 1. To mobilize everyone to take action to end child cruelty 2. To give children the help, support, and environment they need to stay safe from cruelty 3. To find ways of working with communities to keep children safe from cruelty 4. To be, and be seen as, someone to turn to for children and young people

Canadian Centre for Child Protection The Canadian Centre for Child Protection (CCCP) is a charitable organization whose goal is to reduce child victimization by providing programs and services to Canadians. The following describe the mission of the Canadian Centre for Child Protection: • To reduce the incidence of missing and sexually exploited children • To educate the public on child personal safety and sexual exploitation • To assist in finding the location of missing children • To advocate for and increase awareness about issues relating to child sexual exploitation The Canadian Centre for Child Protection does the following: • Delivers programs to increase the personal safety of children and reduce their risk of sexual exploitation • Prevents harm to children through education and prevention programs for children, families, schools, and communities • Receives and addresses reports of child pornography, online luring, child sex tourism, and children exploited through prostitution • Maintains comprehensive data on the latest trends in child victimization and develops training and programs to address the risks • Accepts tips from the public and assists in locating missing children • Advocates on issues relating to child victimization and protection • Researches better practices on how to keep children safer • Coordinates national efforts in the area of child protection through collaboration with nonprofit agencies, government, industry, law enforcement, educators, and families Figure 11-24 shows the CCCP Web site.

11-36

Chapter 11

Source: http://www.protectchildren.ca/app/en/. Accessed 2/2007.

Figure 11-24

The CCCP educates the public about child exploitation on the Internet.

Source: http://www.cybertip.ca/. Accessed 2/2007.

Figure 11-25 of children.

Cybertip.ca allows people to report the online sexual exploitation

Cybertip.ca Cybertip.ca is Canada’s national tip line for reporting the online sexual exploitation of children. The following is the procedure for reporting about child pornography on Cybertip.ca: 1. Go to http://cybertip.ca. 2. Click on Click here to report (Figure 11-25).

Anti-Child-Pornography Organizations

11-37

3. Write details about the site. 4. Submit the report.

Association of Sites Advocating Child Protection The Association of Sites Advocating Child Protection (ASACP) is a nonprofit organization dedicated to eliminating child pornography from the Internet. It battles child pornography through its reporting hotline and by organizing the efforts of online organizations to combat the sexual abuse of children. It also works to help parents prevent children from viewing age-inappropriate material online. Figure 11-26 shows the ASACP Web site.

Web Sites Against Child Porn Web Sites Against Child Porn (WSACP) is an anti-child-pornography organization. Its goal is to stop as many child pornography Web sites as possible and make the Internet a better place for everyone. It provides feedback on all reports submitted with a valid e-mail address. When a user submits a suspect site online, the staff of WSACP will inform the user if the suspect site has been reported to the authorities or not, if they were unable to report the suspect site to the authorities, and any reasons why they were unable to report the site.

Report Child Porn Report Child Porn is a hotline for Webmasters and surfers to report suspected child pornography. It offers the following: • A way to report child pornography • An avenue to discuss problems related to child pornography Figure 11-27 shows the Report Child Porn Web site.

Child Focus The European Centre for Missing and Sexually Exploited Children, operating under the name of Child Focus, is a foundation under Belgian law. It acts on an independent basis and only in the interest of children.

Source: http://www.asacp.org/. Accessed 2/2007.

Figure 11-26 Internet.

ASACP is dedicated to eliminating child pornography from the

11-38

Chapter 11

Source: http://www.reportchildporn.com/. Accessed 2/2007.

Figure 11-27

Report Child Porn allows people to report child pornography Web sites.

Source: http://www.childfocus.be/en/index.php. Accessed 2/2007.

Figure 11-28

Child Focus is a Belgian organization that fights child exploitation.

The following are the features of Child Focus: • It provides active support in the investigation of the disappearance, abduction, or sexual exploitation of children. • It supports and encourages investigations and legal measures. • It ensures follow-up to the cases that are entrusted to it and participates in the counseling of victims. Figure 11-28 shows the Child Focus Web site.

Chapter Summary

11-39

Source: http://www.stopchildporno.be/index.php?language=en. Accessed 2/2007.

Figure 11-29 StopChildPorno.be is a Belgian Web site for reporting child pornography images.

StopChildPorno.be StopChildPorno.be is the Belgian civil hotline for reporting child abuse images found on the Internet. It informs citizens about the problem of child pornography on the Internet, Belgian legislation concerning this matter, different possibilities to report, procedures, and addresses of other hotlines abroad. The following steps explain how to report a Web site: 1. Go to http://www.stopchildporno.be/index.php?language=en. The Web site is shown in Figure 11-29. 2. Click on Report a Site. 3. Check either I want to be anonymous or I want to be informed and click Continue. 4. Indicate which type of report to submit. 5. Copy and paste the URL of the Web site. 6. Submit the report.

Chapter Summary ■

Child pornography is defined as any work that centers on activities involving the sexual behavior of children. Such works include drawings, cartoons, sculptures, paintings, photography, films, videos, images, and pictures, whether made or produced by electronic, mechanical, or other means. It also includes distribution and possession of pornographic materials.

■

Criminals involved in pornographic cases are generally unmarried, separated, divorced, or widowed. Motives of people can range from mere money making to sexual perversion. Child pornographers attract children by coercion, seduction, payment, blackmail, and solicitation.

11-40

Chapter 11

■

The Internet provides easy access to a number of pornographic materials and reduces the cost of production and distribution of such materials. An offender can easily distribute the materials through e-mails, newsgroups, and webcams.

■

Child pornography affects children physically, socially, and psychologically.

■

ISPs (Internet service providers) play an important role in reducing the problem of child pornography. They can block illegal sites, apply filters to browsers and search engines, and create complaint sites.

■

The police play a crucial role in investigating pornographic sites. They may use computer forensic tools and techniques to investigate such sites. They may also use honeytrap sites to find offenders.

■

The challenges in controlling child pornography include the large amount of Internet traffic, a lack of rules and regulations in certain countries, and the advanced techniques offenders use.

■

An offender’s computer, handheld devices, and servers are the main sources of evidence for an investigation.

■

There are many anti-child-pornography organizations around the globe that seek to stop the sexual exploitation of children; these organizations offer reporting capabilities, education, training, and other services.

Review Questions 1. What are the motives of people involved in child pornography? _______________________________________________________________________________________________ _______________________________________________________________________________________________ 2. Explain the role of the Internet in promoting child pornography. _______________________________________________________________________________________________ _______________________________________________________________________________________________ 3. What are the effects of child pornography on children? _______________________________________________________________________________________________ _______________________________________________________________________________________________ 4. How can the dissemination of child pornography be prevented? _______________________________________________________________________________________________ _______________________________________________________________________________________________ 5. What are the challenges involved in controlling child pornography? _______________________________________________________________________________________________ _______________________________________________________________________________________________ 6. List the guidelines for investigating child pornography cases. _______________________________________________________________________________________________ _______________________________________________________________________________________________ 7. List the sources of digital evidence during an investigation. _______________________________________________________________________________________________ _______________________________________________________________________________________________ 8. List the guidelines for parents to reduce the risk of their children becoming exposed to child pornography. _______________________________________________________________________________________________ _______________________________________________________________________________________________

Hands-On Projects

11-41

9. Describe four tools that parents can use to protect their children from accessing pornography. _________________________________________________________________________________________________ _________________________________________________________________________________________________ 10. Describe the various anti-child-pornography organizations. _________________________________________________________________________________________________ _________________________________________________________________________________________________

Hands-On Projects 1. Perform the following steps: ■

Go to the National Child Exploitation Coordination Centre (NCECC) Web site at http:// www.ncecc.ca.

■

Click on the Reporting child exploitation link.

■

Read “How to Report Internet Pornography or Internet Luring Related to Children.”

2. Perform the following steps: ■

Go to the Project Safe Childhood (PSC) Web site at http://www.projectsafechildhood.gov.

■

Click on PSC Media Fact Sheet and read about Project Safe Childhood’s initiatives.

3. Perform the following steps: ■

Navigate to Chapter 11 of the Student Resource Center.

■

Install and launch iProtectYou.

■

Explore the various options.

This page intentionally left blank

Index 18 U.S.C. § 2252A/B, 7-27

BillSniff, 2-27, 2-28

investigation steps, 11-4–11-11

A

BrowseControl, 11-15

investigation tools for, 11-12–11-16

Buffer overflow attacks, 3-6–3-7, 5-4

Japanese laws against, 11-24

Acceptable level of loss, 8-5

C

legislation survey, 11-17–11-22, 11-17–11-22

AccessDiver, 3-26, 3-27

Cache, 11-8

ActiveWhois, 3-44, 3-45

Cache poisoning, 2-8–2-9

Activeworx Security Center, 1-17, 1-18

CallerIP, 3-47

Activity Monitor, 8-8–8-9

Canadian Centre for Child Protection (CCCP), 11-35, 11-36

Abuse.Net, 7-5

Activity profiling, 5-8 Acunetix Web Vulnerability Scanner, 3-24–3-25

Canadian laws, for trademarks and copyright, 9-38

Michigan laws against, 11-23 people involved in, 11-2 people’s motives behind, 11-2 Philippine laws against, 11-26 precaution before investigating, 11-4 preventing dissemination of, 11-3–11-4

CAN-SPAM Act, 7-26

reducing risk for exposure to, 11-12

CenterTrack method, 5-14

Scottish laws against, 11-25

Admin’s Server Monitor, 5-17, 5-18

Centralized binary logging, 1-7–1-8

sources of digital evidence, 11-11

AlterWind Log Analyzer, 3-22

CentralOps.net, 6-12–6-13

South African laws against, 11-24–11-25

Analog (tool), 3-16, 3-18

CERT Coordination Center/SEI Study on insider threats, 8-7

U.K. laws against, 11-25

Adaptive Security Analyzer (ASA) Pro, 1-14–1-15, 1-16

AnalogX PacketMon, 2-26, 2-28 Anti-Child Porn Organization (ACPO), 11-28–11-29 AOL, viewing and copying e-mail headers in, 7-10 Apache logs, investigating, 3-12–3-13 Application layer, of main protocols, 2-4–2-5 AppScan, 3-26, 3-27 ARP table, evidence gathering from, 2-9 Association of Sites Advocating Child Protection (ASACP), 11-37 Atelier Web Ports Traffic Analyzer, 2-30, 2-31 Attacks, types of, 2-6 Audit logs, 1-8 Australian laws against child pornography, 11-23 on sexual harassment, 10-11–10-12 for trademarks and copyright, 9-35–9-37 Austrian laws, against child pornography, 11-23 Authentication hijacking, 3-7, 3-8 AWStats, 3-19, 3-20

Chain of custody, 1-7, 4-6 ChatGuard, 11-15, 11-16 Chat rooms, 7-7 CHECK, 9-14 Child Exploitation and Online Protection (CEOP), 11-29 Child Exploitation Tracking System (CETS), 11-17 Child Focus, 11-37–11-38 Child pornography anti-child-pornography organizations, 11-26–11-39

U.S. laws against, 11-22–11-23 Children’s Internet Protection Act (CIPA), 11-26 Child Victim Identification Program (CVIP), 11-33, 11-34 Chinese laws on sexual harassment, 10-12 for trademarks and copyright, 9-38 Cisco NetFlow, for DoS attack detection, 5-9 Civil Rights Act (1964), Title VII, 10-10 Civil Rights Act (1991), 10-10 Code injection attacks, 3-5

Australian laws against, 11-23

Colasoft Capsa Network Analyzer, 2-24, 2-26

Austrian laws against, 11-23

Colasoft EtherLook, 2-26, 2-27

Belgian laws against, 11-23–11-24

Common headers, 7-13–7-15

Children’s Internet Protection Act (CIPA), 11-26

Common law torts, 10-11

citizen responsibility in fighting, 11-11 control challenges of, 11-4 Cypriot laws against, 11-24 defined, 11-2

B

effects of, on children, 11-3

Backscatter traceback, 5-11–5-13

English and Welsh laws against, 11-25

Belgian laws

guidelines to avoiding, 11-11–11-12

against child pornography, 11-23–11-24

Internet role in, 11-3

for trademarks and copyright, 9-39

introduction, 11-2

CommView, 2-14–2-15 Computer times, synchronizing, 1-21–1-28 Control channel detection, 5-14–5-15 Cookie poisoning, 3-5–3-6 Cookies, 11-8, 11-9 Cookie snooping, 3-7 Cookie Viewer, 6-15, 6-17 CopyCatch, 9-12, 9-13 Copy Protection System (COPS), 9-12–9-13, 9-14

I-1

I-2

Index

Copyright Act (1968), 9-36–9-37

D

E

Copyright Management Business Law (4.2.2.3) (2000), 9-35

Data link layer

E-mail

Copyrights Australian laws for, 9-35–9-37 Belgian laws for, 9-39 Canadian laws for, 9-38 Chinese laws for, 9-38 enforcement of, 9-10–9-11 Indian laws for, 9-33–9-34 introduction, 9-1–9-2 Japanese laws for, 9-34–9-35 length of, 9-9–9-10 plagiarism, 9-11–9-23 South African laws for, 9-38 South Korean laws for, 9-39 status investigation, 9-9 U.K. laws for, 9-37–9-38 U.S. laws for, 9-30–9-33 Corporate espionage

evidence gathering from, 2-10

specialized forensic tools for, 7-17–7-26

of main protocols, 2-4

tracing, 7-22–7-24

of OSI model, 2-5 Data Recovery Wizard, 11-5, 11-6

E-mail addresses, tracing, 6-22–6-25 E-mail crime

DDoS attacks, 5-5–5-7

investigating, 7-8–7-17, 7-18, 7-19

Deep Log Analyzer, 3-18–3-19

overview, 7-4–7-7

Denial-of-service (DoS) attacks, 4-4

RCW 19.190.020, 7-27

DDoS attacks, 5-5–5-7

types of, 7-4–7-7

defined, 5-2

U.S. laws against (CAN-SPAM Act), 7-26–7-27

detection techniques, 5-8–5-9 indications of, 5-2 introduction, 5-2 investigating, 5-9–5-15 investigation challenges, 5-16 investigation tools for, 5-16–5-20 modes of, 5-7–5-8 types of, 5-2–5-4

E-Mail Detective, 7-20 Email Dossier, 7-16 E-Mail Examiner by Paraben, 7-21, 7-22 E-mail headers common, 7-13–7-15 examining, 7-11–7-15 “received”, 7-13 viewing and copying in AOL, 7-10

defenses against, 8-4–8-5

DHCP database, evidence gathering from, 2-10

defined, 8-1–8-2

Digital evidence, 11-11

viewing and copying in Hotmail, 7-10

information sought by spies, 8-2–8-3

Digital Millennium Copyright Act (DMCA) (1998), 9-30–9-31

viewing and copying in Microsoft Outlook, 7-9

Digital rights management (DRM), 9-26–9-29

viewing and copying in Yahoo! Mail, 7-11, 7-12

insider/outsider threat, 8-3 introduction, 8-1–8-2 motives behind, 8-2 prevention steps, 8-5–8-7 spying techniques, 8-3–8-4 threat due to aggregate of information, 8-3

Directory reversals, 3-9 Diskinternals Outlook Recovery, 7-22, 7-23 Distinct Network Monitor, 2-23

CounterSpy, 8-16, 8-17

Distributed denial-of-service (DDoS) attacks, 5-5–5-7

CounterStorm-1, 3-49

DMZ protocol attacks, 3-7

CountryWhois, 3-46

DNS (Domain Name Service)

CPU utilization, for DoS attack detection, 5-9 Critical assets, 8-5

viewing and copying in Gmail, 7-10–7-11

E-mails chain messages, 7-8 copying messages, 7-9 examining messages, 7-9 investigating crimes and violations, 7-8–7-17, 7-18, 7-19 obtaining bit-by-bit image information, 7-9

poisoning techniques, 2-7–2-9

online programs, 7-15

Web page defacement using, 3-14

personal address book, 7-15

DNS root name servers, 6-7

printing messages, 7-9

Documentation, of evidence gathered on network, 2-45–2-46

spoofing, 7-8

Cross-site scripting (XSS) attacks, 3-2–3-3 Cryptographic interceptions, 3-9

Domain name infringement, 9-25

Cyberbullying, 10-2

Domain Name System (DNS), Internet crimes and, 6-6–6-8

Cross-site request forgery (CSRF), 3-3–3-4

Cyberstalking, 10-6 Cybertip.ca, 11-36–11-37 CyperTipline, 11-33, 11-34 Cypriot laws, against child pornography, 11-24

DoSHTTP, 5-20 dotDefender, 3-25, 3-26

systems, 7-2–7-4 tracking and investigating crimes, 7-2 viewing and copying e-mail headers in AOL, 7-10 eMailTrackerPro, 7-24, 7-25

Dupli Checker, 9-21, 9-22

Employee-monitoring policies, writing guidelines, 8-19–8-20

Dynamic IP addresses, investigating, 3-16

Employee responsibilities, 10-7

Index

I-3

Emsa Web Monitor, 3-28

G

Industry self-regulation (ISP), 11-3

End-to-end forensic investigation, 1-3

InfiniStream, 2-38–2-39, 2-40

English laws, against child pornography, 11-25

General Packet Radio Service (GPRS), 2-35–2-36

Enterprise IP-Address Manager, 3-42, 3-43

German laws, on sexual harassment, 10-12

Innocent Images National Initiative (IINI), 11-27–11-28

Ephemeral, 6-4

GFI EventsManager, 1-15–1-17

Insider threats, 8-3, 8-7

Equal Protection Clause of 14th Amendment, 10-11

Give Me Too, 2-33, 2-34

Intellectual property, 9-25–9-26, 9-39

Glatt, 9-21

IntelliProtector, 9-28, 9-29

EtherApe, 2-24, 2-25 EtherDetect Packet Sniffer, 2-18–2-19

Gmail, viewing and copying e-mail headers in, 7-10–7-11

Intermediate System to Intermediate System (IS-IS), 4-4

Ethernets

GPRS Network Sniffer- Nokia LIG, 2-35–2-36

International Centre for Missing & Exploited Children (ICMEC), 11-31–11-33

shared, 2-6–2-7

Grab-a-Site, 6-18–6-19

switched, 2-7

Grooming, 6-3

EtherScan Analyzer, 2-29

H

EtherSnoop, 2-35

Haihaisoft Media DRM Platform, 9-28

eTrust Network Forensics, 2-39–2-41

Hash-based IP tracebacks, 5-13

EVE2 (Essay Verification Engine), 9-19, 9-21

Hide Real IP, 3-40, 3-41

EventLog Analyzer, 1-20–1-21

Hit-and-run attacks, 4-5

EventReporter, 1-20

Honeypots, 8-5–8-6

Evidence

Honeytokens, 8-5–8-6

log files as, 1-3–1-8 looking for, 1-3 multiple logs as, 1-5 at physical layer, 2-6–2-7 eWebLog Analyzer, 3-23, 3-24 Exchange Message Tracking Center, 7-16, 7-17 Exploit-Me, 3-34

Hong Kong laws, for intellectual property, 9-39 Hop-by-Hop IP traceback, 5-10–5-11 Hostlie work environment harassment, 10-3–10-4 Hotmail, viewing and copying e-mail headers in, 7-10 HP WebInspect, 3-30 HTTP Sniffer, 2-16, 2-18

Internet, role in child pornography, 11-3 Internet Assigned Numbers Authority (IANA), 6-6 Internet crimes Internet forensics, 6-4 introduction, 6-2 investigation goals, 6-4 investigation steps, 6-4–6-8 investigation tools for, 6-8–6-27 types of, 6-2–6-3 Internet Crimes Against Children Task Force (ICAC), 11-28 Internet DNS spoofing (remote network), 2-8 Internet Service provider (ISP), 6-6 Internet Spy Filter, 8-12, 8-13 Internet Watch Foundation, 11-31 Internetwork addressing, 2-2–2-3 Intranet DNS spoofing (local network), 2-8

F

I

Intrusion detection, 1-5, 3-15

Fair Use Doctrine, 9-31–9-32

ICMP traceback, 5-10

Falcove Web Vulnerability Scanner, 3-28

Identity theft, 7-8

Intrusion detection system (IDS), evidence gathering from, 2-10

FINALeMAIL, 7-20

ID Protect, 7-26

Financial Coalition Against Child Pornography (FCACP), 11-33

IDS (intrusion detection system), evidence gathering from, 2-10

Firefox, 6-15, 6-16, 6-18, 6-22

IDS Policy Manager, 2-45, 2-46

examining the origin of, 7-16

Firewall Analyzer, 1-13–1-14, 1-15

IE HTTP Analyzer, 2-29

Internet crimes and, 6-5–6-6

Forensic Linguistics Institute, 9-22–9-23

IISLogger, 1-8, 1-9

investigating, 3-16

Forensics, vs. router forensics, 4-5

IIS logs, 1-5–1-6

locating, 5-15

Forensic Toolkit (FTK), 7-19–7-20

investigating, 3-12

Intrusion process, 1-2 IP2country, 3-46 IP addresses

IP Address Locator, 6-12, 6-13

Fourteenth Amendment, 10-11

IMAP (Internet Message Access Protocol), 7-4

IP.com, 9-24–9-25

Fraggle attacks, 5-3–5-4

iMonitorPC, 8-17, 8-19

IP Detective Suite, 3-40, 3-41

Friendly Pinger, 5-16–5-17

Impersonation attacks, 3-10

IPgrab, 2-32

FTP compromises, 3-11

Indian laws

IPHost Network Monitor, 5-17, 5-18

FTP logs, investigating, 3-11–3-12

on sexual harassment, 10-12

iProtectYou, 11-12–11-13

FTP servers, investigating, 3-12

for trademarks and copyright, 9-33–9-34

IPSec, 5-13

I-4

Index

IP Sniffer, 2-30, 2-31

Mail user agent (MUA), 7-2

Network Probe, 2-43

Iris Network Traffic Analyzer, 2-19–2-20, 2-21

Malaysian penal code, on sexual harassment, 10-12

Network protocols, overview, 2-3–2-5

IS-IS (Intermediate System to Intermediate System), 4-4

Mapper, 3-32

Network Time Protocol (NTP), 1-21–1-27

McAfee Visual Trace, 3-37, 3-38

Network traffic

iThenticate, 9-20, 9-21

J Japanese laws against child pornography, 11-24 for trademarks and copyright, 9-34–9-35 JavaScript, 6-17–6-18 JPlag, 9-15

Media Access Control (MAC) address, 2-2

data link layer of OSI model, 2-5

Michigan laws, against child pornography, 11-23

DNS poisoning techniques, 2-7–2-9

Microsoft Log Parser, 1-12–1-13, 1-14 Microsoft Outlook, 7-15 viewing and copying e-mail headers in, 7-9 Moles, detecting, 8-6 Monitoring, 8-6

K keepNI, 3-31–3-32

Multiple logs, 1-5 My Offline Browser, 6-19–6-20

Kiwi Syslog Daemon, 1-12, 1-13

L LAN addressing, 2-2 LAND attacks, 5-3 Lanham (Trademark) Act, 9-31–9-32 LanWhoIs, 3-45 Link Logger, 4-17–4-18 Linux, process accounting, 1-18–1-19 Local area network (LAN), 2-2 LOCIS, 9-9, 9-10 LockLizard, 9-28, 9-29 Log files authenticity of, 1-7 as evidence, 1-3–1-8 missing, 1-7 multiple, 1-5 tampering with, 3-8 Log-input, tracing with, 5-14 Logs, investigating introduction, 1-2 log files as evidence, 1-3–1-8 tools for, 1-8–1-21 LoPe, 7-24, 7-25

M

documenting evidence, 2-45–2-46 evidence gathering at data link layerDHCP database, 2-10 evidence gathering at physical layer, 2-6–2-7 evidence gathering from ARP table, 2-9 evidence gathering from IDS, 2-10 introduction, 2-2 investigation tools for, 2-10–2-45

N

network addressing, 2-2–2-3

Nagios, 2-33

network layer of OSI model, 2-5–2-6

National Center for Missing & Exploited Children (NCMEC), 11-33

OSI reference model, 2-3

National Society for the Prevention of Cruelty to Children (NSPCC), 11-35

physical layer of OSI model, 2-5 protocols overview, 2-3–2-5

NeoTrace (McAfee Visual Trace), 6-25, 6-26

reasons for investigating, 2-6

NETGEAR router logs, 4-13–4-14, 4-15

reconstructing evidence for investigation, 2-46–2-47

NetIntercept, 2-12, 2-13 NetResident, 2-38 NetScan Tools, 6-26, 6-27 NetSetMan, 2-21–2-22 Netspionage, 8-7 NetVizor, 8-11 NetWitness, 2-37 Network Abuse Clearinghouse, 7-5 Network E-Mail Examiner by Paraben, 7-22 Network forensics data analysis, 1-2 end-to-end, 1-3 introduction, 1-2 intrusion process, 1-2–1-3

transport layer of OSI model, 2-6 types of attacks, 2-6 NIC (network interface card), 2-2 NIDS (Network Intrusion Detection System), for DoS attack detection, 5-9 Nmap, 5-16 Nokia LIG, 2-35–2-36 Nslookup, 3-34, 3-36, 6-8–6-9 N-Stalker, 3-33 N-Stealth, 3-23, 3-24 ntop, 2-24, 2-25 NTP (Network Time Protocol), 1-21–1-27 NTsyslog, 1-19–1-20 Nuke attacks, 5-4

looking for evidence, 1-3 NTP, 1-21–1-28

MaaTec Network Analyzer, 2-23, 2-24

Network Intrusion Detection System (NIDS), for DoS attack detection, 5-9

MAC (Media Access Control) address, 2-2

Network interface card (NIC), 2-2

Mail bombing, 7-6–7-7

Network layer

O ODBC logging, 1-8 OmniPeek, 2-19 Online Copyright Infringement Liability Limitation Act, 9-32–9-33

MailDetective, 7-16–7-17, 7-18

of main protocols, 2-4

OOB attacks, 5-4

Mail storm, 7-7

of OSI model, 2-5–2-6

Open Shortest Path First (OSPF), 4-4

Index OSI reference model

Project Safe Childhood (PSC), 11-27

Sexual harassment

overview, 2-3

Promiscuous attacks, 2-7

Australian laws on, 10-11–10-12

routers on, 4-2

Protocols, overview, 2-3–2-5

Chinese laws on, 10-12

Proxy servers, DNS poisoning on, 2-8, 2-9

complaint procedures, 10-7–10-8

Q

consequences of, 10-4

OSPF (Open Shortest Path First), 4-4 Outsider threats, 8-3

P

Quid pro quo harassment, 10-3

P2 Enterprise Shuttle, 2-41

defined, 10-2 dos and don’ts for employees, 10-5

R

employee responsibilities, 10-7

“Received” headers, 7-13

German laws on, 10-12

Pandora FMS, 3-49

Recover My Email for Microsoft Outlook, 7-22

Indian laws on, 10-12

Paper mills, 9-11

Reflected attacks, 5-4

Parameter tampering, 3-5

Reliance party, 9-10

Paros, 3-29–3-30

Remote logging, 1-9–1-10

Packet marking, 5-14 Packet-mistreating attacks, 4-5

Patents, 9-23–9-25 infringement, 9-24 introduction, 9-23 search for, 9-24 types of, 9-23–9-24

Report Child Porn, 11-37, 11-38 Reveal, 11-12 R-Mail, 7-20, 7-21 Router Audit Tool (RAT), 4-16–4-17 Router forensics

Patents (Amendment) Act (1999), 9-33

definition of router, 4-2

Path identification (Pi) method, 5-15

functions of a router, 4-2–4-4

PC Inspector File Recovery, 11-5, 11-6

introduction, 4-2

Persistent attacks, 4-5

investigating router attacks, 4-6–4-16

Perverted Justice, 11-35

router attacks, 4-4–4-5

Philippine laws, against child pornography, 11-26

router vulnerabilities, 4-4 tools for, 4-16–4-18

Phishing, 7-8, 7-17, 7-18

vs. traditional forensics, 4-5

Physical layer, of OSI model, 2-5 Ping of death attacks, 5-2

Router logs, 4-12–4-13

Plagiarism

Routing Information Protocol (RIP), 4-3–4-4

detection factors, 9-11–9-12 detection tools, 9-12–9-23

introduction, 10-2 investigation process, 10-8–10-9 Malaysian penal code on, 10-12 policies, 10-9 preventive steps, 10-9–10-10 stalking, 10-5–10-6 stalking laws, 10-15 statistics, 10-4 supervisors responsibilities, 10-7 types of, 10-2–10-4 U.K. laws on, 10-12 U.S. laws on, 10-10–10-11 Sherlock, 9-17, 9-19 Show Traffic, 2-42 Siemens Monitoring Center, 2-36–2-37 Signature analysis, 8-6–8-7 Simple Mail Transfer Protocol (SMTP), 7-3 SIM (Software Similarity Tester), 9-16, 9-17 SmartSniff, 2-21, 2-22

Routing table, 4-3–4-4

SmartWhois, 3-44

Routing table poisoning, 4-5

SMTP (Simple Mail Transfer Protocol), 7-3

S

Smurf attacks, 5-3

prevention steps, 9-11 types of, 9-11

I-5

PlagiarismDetect.com, 9-21, 9-22

SafeAssignment, 9-19, 9-20

PLAGUE, 9-16–9-17

Sample complaint form, 10-12–10-14

POP3 (Post Office Protocol version 3), 7-3–7-4

Samspade, 6-12

Post Office Protocol version 3 (POP3), 7-3–7-4

Sawmill, 4-18

PRAISE, 9-19, 9-20

Scottish laws, against child pornography, 11-25

Presentation layer, of main protocols, 2-4–2-5

Scrawlr, 3-34

Privatefirewall, 8-11–8-12

Search warrants, 6-4–6-5, 7-8–7-9

Probabilistic packet monitoring (PPM), 5-14

Security, for Web applications, 3-15

Process accounting, 1-18–1-19

Sequential change-point detection, 5-8

ProDiscover Investigator, 2-41, 2-42

Server Log Analysis (tool), 3-20

Profiling, 8-6

Session layer, of main protocols, 2-4–2-5

Sniff-O-Matic, 2-33, 2-34 Sniphere, 2-29–2-30 Snork attacks, 5-4 Snort Intrusion Detection System, 2-43–2-44 Socklog, 1-10–1-11 SoftPerfect Network Protocol Analyzer, 2-15–2-16, 2-17 South African laws against child pornography, 11-24–11-25 for trademarks and copyright, 9-38 South Korean laws, for trademarks and copyright, 9-39

I-6

Index

Spam Arrest, 7-6, 7-7

South African laws for, 9-38

Spamming, 7-5–7-6

South Korean laws for, 9-39

indications of, 3-2

SPAM Punisher, 7-5–7-6

trade dress and, 9-2

introduction, 3-1

Spector CNE, 8-9

U.K. laws for, 9-37–9-38

intrusion detection, 3-15

SPlaT, 9-17, 9-18

U.S. laws for, 9-30–9-33

investigating, 3-11–3-13

Spybot-Search & Destroy, 8-12, 8-13

Trade Marks Act (1995), 9-35–9-36

SpyBuddy, 8-10–8-11

Trade Marks Act (1999), 9-33–9-34

SpyCop, 8-12–8-13, 8-14

Trademarks Act (TMA) (1994), 9-37–9-38

Spy Sweeper, 8-14, 8-16

Transport layer

Spyware Terminator, 8-14, 8-15

of main protocols, 2-4

SQL injection attacks, 3-4–3-5

of OSI model, 2-6

SQL Inject-Me, 3-34, 3-35 Stalking, 10-5–10-6, 10-15 Stanford Copy Analysis Mechanism (SCAM), 9-14, 9-15 Static IP addresses, investigating, 3-16

Web attacks

investigating static and dynamic IP addresses, 3-16 investigation tools for, 3-16–3-34, 3-47–3-49 overview of web logs, 3-10–3-11 security strategies for Web applications, 3-15 statistics, 3-16 tools for locating IP addresses, 3-34–3-47

Turnitin, 9-12, 9-13

types of, 3-2–3-10

U

web page defacement, 3-13–3-15

Uniform Resource Locator (URL), 3-5

Web security checklist, 3-16

United Kingdom laws

Web Control for Parents, 11-13, 11-14

Status2k, 5-19

against child pornography, 11-25

WebLog Expert, 3-20–3-21

StopChildPorno.be, 11-39

on sexual harassment, 10-12

Web logs, 3-10–3-11

Stratum levels, 1-22–1-27

for trademarks and copyright, 9-37–9-38

Web page defacement, 3-13–3-15

SUPERAntiSpyware, 8-17, 8-18

United States laws

Web pages, recovering information from, 6-22

Supervisors responsibilities, 10-7

against child pornography, 11-22–11-23

Web Sites Against Child Porn (WSACP), 11-37

SurfOffline, 6-19, 6-20

for trademarks and copyright, 9-30–9-33

WebWatchBot, 3-29

SYN flooding, 5-3 Syslog, 1-8–1-9 Syslog-ng, 1-10, 1-11

United States Patent and Trademark Office (USPTO), 9-2 Urkund, 9-19 URL interpretation attacks, 3-9

T

URL redirection, 6-15, 6-17

Tail4Win, 5-18, 5-19 Tcpdump, 2-10, 2-11 Teardrop attacks, 5-3 Think U Know, 11-29–11-30 Three-way handshake, 5-3 Title VII of Civil Rights Act (1964), 10-10 Traceroute, 3-36–3-37, 6-13–6-14 Track4Win, 8-9, 8-10 Trademarks Australian laws for, 9-35–9-37

URL (Uniform Resource Locator), 3-5

Welsh laws, against child pornography, 11-25 WHOIS, 3-38–3-40, 6-9–6-12 Whois Lookup, 3-42, 3-43 Whois.Net, 3-47, 3-48 Wikto, 3-32

U.S. Copyright Office, 9-10

Windows-based servers, investigating attacks in, 3-13

U.S. Secret Service, 8-7

Windows logging, 1-19

UTC time, 1-6

Windows Media Digital Rights Management (DRM), 9-26, 9-27

UV Uptime Website Defacement Detector, 3-49

V VAST, 9-15–9-16 Victim, interviewing, 6-5

Windows time service, 1-27–1-28 WinDump, 2-11–2-12 Wireshark, 2-13–2-14 Www.whatismyip.com, 3-40, 3-41

Virtual Global Taskforce (VGT), 11-30

X

VisualRoute, 6-22, 6-23

XoftSpySE, 8-14, 8-15

Volatile evidence, 4-9–4-11

XSS-Me, 3-34, 3-35

Indian laws for, 9-33–9-34

W

Y

infringement, 9-3–9-9

Wavelet-based signal analysis, 5-9

introduction, 9-1

Wayback Machine, 6-21

Yahoo! Mail, viewing and copying e-mail headers in, 7-11, 7-12

Japanese laws for, 9-34–9-35

WCopyfind, 9-20

Z

registration eligibility and benefits, 9-2

WebAgain, 3-47, 3-48

Zero-day attacks, 3-7

vs. service mark, 9-2

Webalizer, 3-22, 3-23

Zombies, 5-5

Belgian laws for, 9-39 Canadian laws for, 9-38 Chinese laws for, 9-38

This page intentionally left blank

General Notice The EC-Council | Press Series’ mission is to educate, introduce and demonstrate Information Security related tools and techniques for internal security analysis purposes only. You will not use the newly acquired skills for illegal or malicious attacks and you will not use such tools in an attempt to compromise any computer system, and you shall indemnify EC-Council and its partners from all liability with respect to the use or misuse of these tools, regardless of intent. EC-Council provides the hacking skills and tools presented throughout the EC-Council | Press for educational use. The hacking tools are not authored by EC-Council, and in many cases are submitted by the security community. EC-Council will not be held accountable for any damages caused by the proper or improper usage of these materials, and makes no guarantee in regards to their operation or suitability for any specific purpose. The hacking tools used in the EC-Council | Press programs are meant for research and educational purposes only. The primary intent of these tools is to provide the user with hard to find content for research or self education relevant to network security and various protection methods and their intrinsic flaws by demonstrating exploitation methods and techniques used to circumvent them. We hope that you become more aware of the dangers that lurk in society today and learn how to protect yourself from them with the knowledge you are about to learn. In order to continue you must accept that you are going to use this information only for educational and research purposes only. While possession of information or programs included in this training violates no laws, actually using or implementing some of the programs or content may violate U.S. Federal and other laws. For this reason, the user is instructed not to use any programs or content contained in this training which may violate any laws or infringe on the rights, including intellectual property rights, of others. We provide them for research and educational purposes only.